Manage Secret API Keys in Medusa Admin

In this guide, you'll learn how to create and manage secret API keys in the Medusa Admin.

What is a Secret API Key?#

A secret API key is an authentication token that allows you to access Medusa's Admin APIs. You can pass it in request headers to send requests as an authenticated admin user. So, it's important to not expose the secret API key in client-side code or public repositories.

To learn how to pass the secret API key in request headers, refer to the API Reference.

View Secret API Keys#

To view the secret API keys of the currently logged-in user in the Medusa Admin, go to Settings -> Secret API Keys.

Here, you can see a list of all the secret API keys for the logged-in user. You can also search, filter, and sort the API keys to find the one you are looking for.

Create Secret API Key#

When you create a secret API key, you create it for the currently logged-in user. A user can have one active secret key at a time. So, if you already have one, you must revoke it before creating a new one.

To create a new secret API key for the currently logged-in user:

1. Go to Settings -> Secret API Keys.
2. Click the Create button at the top right.
3. In the form that opens, enter the secret API key's title.
4. Once you're done, click the Save button.
5. You'll get a pop-up with the secret API key. Copy it and store it securely before closing the pop-up, as you won't be able to see it again.

View Secret API Key Details#

To view the details of a secret API key:

1. Go to Settings -> Secret API Keys.
2. Click on a secret API key from the list.

This opens the secret API key's details page where you can also manage the API key.

Secret API Key Status#

You can see the status of the secret API key at the top right of the first section in the details page. A secret API key's status can be:

Edit Secret API Key#

To edit a secret API key:

1. Go to the secret API key's details page.
2. Click the at the top right of the first section.
3. Choose "Edit" from the dropdown.
4. In the side window that opens, you can edit the secret API key's title.
5. Once you're done, click the Save button.

Revoke Secret API Key#

To revoke a secret API key:

1. Go to the secret API key's details page.
2. Click the at the top right of the first section.
3. Choose "Revoke API key" from the dropdown.
4. Confirm revoking the API key by clicking the "Revoke API key" button in the pop-up.

Delete Secret API Key#

You can only delete a secret API key after revoking it. To delete a secret API key:

1. Go to the secret API key's details page.
2. Click the at the top right of the first section.
3. Choose "Delete" from the dropdown.
4. Confirm deleting the API key by clicking the Delete button in the pop-up.