API key integrations

API key integrations let server-side vendor systems call the COPE public API for one COPE business. Each key has a mode, a public prefix, a secret shown only once, an active state, and last-used metadata.

Lifecycle

Action	Guidance
Create	Create a named integration in the COPE dashboard and copy the secret immediately.
Store	Store the full token in a server-side secret manager. Do not expose secret keys in browsers or mobile apps.
Rotate	Create a replacement key, deploy it, confirm traffic, then deactivate the previous key.
Deactivate	Deactivated keys stop authenticating within 60 seconds. Activate the key again to restore it.
Delete	Delete keys that are no longer needed after confirming no clients use them. A deleted key stops authenticating within 60 seconds and cannot be restored.

Key format

New keys use the format ck_live_<prefix>_<secret>: a 12-character alphanumeric prefix that identifies the key and is safe to display, and a 48-character lowercase hexadecimal secret that is shown only once. Keys issued earlier in the format cope_sk_live_<key_id>_<secret> keep working unchanged.

Where keys are managed

Create, activate, deactivate, and delete API keys in the COPE dashboard under Settings → API Keys. The full token is shown only once, when the key is created. COPE does not store it and cannot show it again. Keys are managed only in the dashboard. The public API has no key-management endpoints, so an API key cannot create, activate, deactivate, or delete keys.

Changelog

Reference

API key integrations

API key integrations

Lifecycle

Key format

Where keys are managed

​API key integrations

​Lifecycle

​Key format

​Where keys are managed

API key integrations

Lifecycle

Key format

Where keys are managed