Create an app and manage its keys

Before you start#

Registration creates two apps for your account, one for Sandbox and one for Production, each with one key. An app can hold several keys at once, and each key works on every product the app is subscribed to.

Steps#

1. Open your apps and choose the app of the environment you want.
2. Add a second key to the app. The first key keeps working.
3. Deploy the new key to your servers at your own pace.
4. When no server uses the old key any more, delete it from the app.

Both keys stay valid until you delete one, so there is no moment when neither works.

Keep the key on the server#

Never put a key in a browser, a mobile app or a public repository. A key that appears in a JavaScript bundle can be copied by anyone who loads the page. If a call must start in the front end, send it through your own server, which adds the key.

Check that it worked#

A call with the new key returns the same response as with the old one. After you delete the old key, a call with it returns 403 with No active subscription for this product.

If something goes wrong#

• A 403 right after the switch usually means the key of the other environment's app. Each app has its own keys.
• If a key may have been exposed, add a new key and delete the exposed one straight away.