API Keys & Credentials
Fenicia provides tools for developers and technical users who need programmatic access to the platform or need to securely store credentials for external services.
API Keys
API keys allow you to authenticate with the Fenicia API from external applications, automation scripts, or custom integrations.
Only the account owner can manage API keys
Creating, listing, revoking, and deleting API keys is currently restricted to the tenant owner. A member with an administrator or manager role cannot manage them, even with broad settings permissions. If someone else needs a key, the account owner has to create it.
Generating an API Key
Open the section
Go to Settings → API Keys and click Generate new key.
Name the key and choose its permissions
Give it a descriptive name that identifies its use (e.g. "ERP integration", "Sync script") and check the permissions it needs: for each resource, you select which actions it can perform. See API key permissions below.
Copy the key
The key is shown only once, at creation time. Copy it and store it somewhere safe — you will not be able to view it again from the panel.
The generated key carries the fkapi_ prefix and is sent on every request as a Bearer token:
Authorization: Bearer fkapi_1m8x2z9k_3f9a1c2d4e5f6789abcd0123ef456789API key security
API keys grant access to your account. Never share a key in public repositories, emails, or insecure channels. If you suspect a key has been compromised, revoke it immediately.
Limit of 10 active keys
Each account supports a maximum of 10 active API keys. If you hit the limit, revoke or delete the ones you no longer use before generating a new one.
API key permissions
A key's permissions are defined per resource and, within each resource, by the actions it may perform (for example: read orders, but not cancel them).
The resources you can select when creating a key from the panel are: products, orders, customers, channels, inventory, and reports, plus a full-access option.
Tip
Grant each key the bare minimum. An integration that only reads inventory does not need write permissions on orders: if that key leaks, the potential damage is far smaller.
For the technical detail of how these permissions are evaluated when calling the API — including wildcards and the resource:action format — see Permissions and scopes in the API reference.
Managing API Keys
From the API keys panel you can:
| Action | What it does |
|---|---|
| View active keys | List of every generated key, with its creation date and last use |
| Revoke key | Deactivates the key: it stops working immediately, but the record is kept in the history |
| Delete key | Removes the record entirely |
Revoking and deleting are not the same
Revoking deactivates the key while keeping its record, which is useful for auditing: you know it existed, who created it, and when it was last used. Deleting removes the record permanently. In both cases the key stops working instantly and there is no way to reactivate it from the panel — if you make a mistake, you will have to generate a new key and update your integration.
There is no «regenerate» button
To rotate a key, the procedure is manual and in this order: generate a new key, update your integration to use it, verify that it works, and only then revoke the old one. That way you avoid a window of downtime.
Tip
Review your active API keys periodically and revoke the ones no longer in use. The last use column helps you spot forgotten keys.
Third-Party Credentials
Beyond API keys — which let other systems get into Fenicia — there is a credentials store for the opposite case: letting Fenicia call an external service from an HTTP step in an automation.
These credentials live in Automations
The credentials store belongs to the automations engine and is managed from that section, not from Settings. It is used to authenticate the HTTP steps of your automated flows.
Credential Types
| Type | Description | Example |
|---|---|---|
| API Key | Simple authentication key | Shipping services, payment gateways |
| OAuth2 | Authentication with access and refresh tokens | Marketplaces, social networks |
| Bearer Token | Bearer token for REST APIs | Analytics services |
| Basic Auth | Encoded username and password | Legacy systems, ERPs |
| Custom Headers | Custom authentication headers | Proprietary APIs |
Adding Credentials
Select the type
From the automations section, open the credentials store and select the type you need to save.
Enter the details
Fill in the fields required by that type: key, secret, token URL, and so on.
Test the connection
Use the Test button to verify the credentials are valid before saving.
Save
Credentials are stored and used only in the automation steps that reference them.
Validating Credentials
The validation feature lets you test credentials without running a full operation:
- Green status — valid credentials, connection successful
- Red status — invalid credentials or service unavailable
- Yellow status — credentials close to expiring (OAuth2)
Automatic renewal
For OAuth2 credentials, Fenicia attempts to refresh access tokens automatically before they expire. If the refresh fails, you will receive a notification to re-authorize the service.
Automation
API keys and credentials enable automation flows such as:
- Inventory synchronization with ERP systems
- Automatic order import from custom channels
- Programmatic report generation
Security Best Practices
- Generate a different key for each integration or service, so you can revoke one without affecting the others
- Grant each key the minimum permissions it needs
- Rotate keys periodically using the procedure above (create → migrate → revoke)
- Check the last use column to spot forgotten keys
- Immediately revoke any compromised key
Related Articles
- API authentication — how to authenticate your requests and what a failure returns
- API Keys management (technical reference) — full lifecycle
- Users & roles — permissions and access control
- Business profile — general configuration
- Connecting channels — integrate marketplaces and services