API keys

Authorization: Bearer uv_live_YOUR_KEY

A key authenticates an organization, not a user. There are no scopes: a key can use the complete API of its organization.

Make a key

Open Developers → API keys in the dashboard.

You see the secret one time only. Keep it before you close the window.

You can give a key an expiry date. If you do, set a reminder. If you revoke a key, it stops immediately and you cannot undo this.

Prefix	Creates	Reads
`uv_live_`	Live orders	Live orders
`uv_test_`	Test orders	Test orders

No field in a request can change this.

A key reads its own mode only. A test key that reads a live order gets order_not_found. See Test mode.

The request also needs an active subscription, and a plan with features_standardApi or features_advancedApi.

A correct key with an unpaid subscription gives subscription_inactive, not an authentication error. See Plans and payment.

Never put a key in a mobile app or a web page.
Keep live and test keys in different configuration.
To replace a key: make the new key, install it, then revoke the old one. In that sequence.
If a key becomes public, revoke it immediately.

Code	Status	Cause
`invalid_api_key`	401	Missing, incorrect or unknown
`api_key_revoked`	401	Somebody revoked it
`api_key_expired`	401	It passed its expiry date
`test_mode_required`	403	A test endpoint with a live key