API keys

API keys grant programmatic access to your Permissio account. If you are building an integration or using the Permissio API directly, you manage your keys here. If you are using the web app only, you can ignore this section.

Key prefixes

Prefix	Environment
sk_test_…	Sandbox — safe for development and testing
sk_live_…	Production — billable, real signatures

Both environments use the same API host (https://api.permissio.us). The key prefix determines which environment your requests target.

Creating a key

1. Go to Settings → API Keys.
2. Click Create API key.
3. Give the key a label (e.g. Local development, CI pipeline, Production backend).
4. Select the environment: Sandbox or Production.
5. Click Create. The key is shown once — copy it immediately and store it in a secret manager.

Warning

Permissio does not store or display secret keys after creation. If you lose a key, revoke it and create a new one — there is no way to retrieve it.

Revoking a key

1. In the API Keys list, find the key you want to revoke.
2. Click Revoke (or the ··· menu → Revoke).
3. Confirm. The key stops working immediately — any integration using it will begin receiving 401 invalid_api_key errors.

Revoke keys promptly if they are exposed, rotated, or no longer needed.

Key security

• Store keys in environment variables or a secrets manager — never hardcode them in source code
• Use separate keys per environment and per application
• Rotate keys on a regular schedule or after any suspected exposure
• Sandbox keys are lower-risk but should still be treated as secrets

For the full API integration guide, see the Developer Docs — Authentication.