API keys
Who can create keys, read vs. write, expiry, limits, revoking, and the company switch.
Who can create keys#
Every active member of a company — owner, admin, manager or staff — can create keys under Settings → API keys. A key is personal: it belongs to the person who created it and to the company it was created in. If you work for two companies, create a key in each.
What a key can do#
A key acts as you. It can never do more than you can do in the app:
- it sees only the brands you have access to (staff limited to some brands see only those);
- your role decides what you may change and delete (see Permissions);
- when your company's trial has ended or the subscription is cancelled, the workspace is read-only — for keys too.
On top of that you choose the key's access:
| Access | Allows | Use for |
|---|---|---|
| Read only | GET requests | Reports, dashboards, exports, BI tools |
| Read and write | GET, POST, PATCH, DELETE | Forms, shop and POS sync, automations |
A read-only key is refused by the database itself on every write, not just by the API.
Expiry#
Choose 7, 30, 90 or 180 days, one year, or no expiry. Prefer an expiry: set a calendar reminder to create a new key and switch over before it runs out.
Limits#
- At most 10 active keys per person per company. Revoke keys you no longer use.
- 120 requests per minute per key (see Rate limits).
The key is shown once#
Quilo shows the full key only right after you create it, and stores only a SHA-256 fingerprint of it. Nobody — not your admin, not TeknoCare — can show it to you again. If you lose it, revoke it and create a new one. In lists you see the prefix, such as qk_0123456789_••••, so you can tell keys apart.
Revoking#
Click Revoke next to a key. It stops working immediately: the next request with it is refused. You can revoke your own keys; owners and admins can revoke any key of the company under Everyone's.
When keys stop working by themselves#
| Situation | API answer |
|---|---|
| The key expired | 401 authentication_failed — "This API key has expired." |
| The key was revoked | 401 authentication_failed — "This API key was revoked." |
| You left the company or were deactivated | 403 permission_denied |
| An owner or admin switched API access off | 403 permission_denied |
| The company is suspended | 403 permission_denied |
The company switch (owners and admins)#
Owners and admins can Switch API off for the whole company. Every key pauses at once and nobody can create new keys. Switch it on again and the existing keys work again. Use it if you suspect a key leaked and don't know which one.
Seeing how keys are used#
The API keys page shows, for each key, when and from which IP address it was last used and how many requests it made in the last 7 days, and lists the most recent requests with method, path, status, time and request ID. Request bodies and query values are never stored. Logs are kept 90 days.
Creating and revoking keys also appears in Settings → Security & activity.