API keys are how your systems authenticate with AdsMAA. Get them right, and you're secure. Get them wrong, and you're vulnerable.

This guide covers everything you need to know.

Understanding API Keys

What is an API Key?

An API key is a secret string that proves your request is authorized. It looks like this:

****

 sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 │  │    │ │  │    └── Unique identifier (32+ characters) │  └── Environment (live or test) └── Key type (sk = secret key) ****

Live vs Test Keys

Creating Keys

Via Dashboard

1. Go to Settings → Developer → API Keys
2. Click Create New Key
3. Enter a descriptive name (e.g., "Production Website Tracking")
4. Select permissions
5. Click Create
6. Copy the key immediately - it's shown only once!

Via API

****`bash POST /api/v1/auth/api-keys Authorization: Bearer {your_user_token} Content-Type: application/json

{ "name": "Production Tracking Key", "permissions": ["tracking"] } ****`

Response: ****

json {   "id": "key_abc123",   "key": "sk_live_a1b2c3d4...",  // Only shown once!   "name": "Production Tracking Key",   "permissions": ["tracking"],   "createdAt": "2024-12-28T10:00:00Z" } ****

Key Permissions

Not every key needs full access. We support granular permissions:

Available Permissions

Recommended Key Configurations

Security Best Practices

Do

• Use descriptive names - "Prod Website Tracking" not "key1"
• Create separate keys for each integration
• Store in environment variables - Never hardcode in source
• Rotate every 90 days - Regular rotation limits exposure
• Revoke immediately if compromised

Don't

• Never commit to Git - Add to .gitignore
• Never share between team members - Each person gets their own
• Never use full permissions when limited would work
• Never use live keys in test environments

Environment Variable Example

****`bash

.env (never commit this!)

ADSMAI_API_KEY=sk_live_a1b2c3d4... ****`

****

javascript // Your code const apiKey = process.env.ADSMAI_API_KEY; ****

Key Rotation

When to Rotate

How to Rotate

1. Create new key with same permissions
2. Update your integration with new key
3. Verify new key works in production
4. Revoke old key once confirmed

Revoking Keys

****

bash DELETE /api/v1/auth/api-keys/{keyId} Authorization: Bearer {your_user_token} ****

Or via dashboard: Settings → API Keys → Click the trash icon.

Recap

Here's what you learned:

• API keys authenticate your requests - Keep them secret
• Use minimum permissions - Tracking-only for website SDKs
• Store in environment variables - Never in code
• Rotate every 90 days - Or immediately if compromised
• Keys can't be retrieved - Save them when created

Your API keys are the front door to your data. Treat them accordingly.

Next step: Install the JavaScript SDK using your new tracking key.