Learn how to create API keys in your Smeetz back-office, control what each key can access, and keep your integrations secure.
1. What API keys are
An API key is a secret code that lets an external system (your website, a partner tool, or a data platform) connect to your Smeetz account without logging in to the back-office.
In Smeetz, every API key belongs to an application. An application represents one integration (for example "Website checkout" or "BI reporting") and defines what its keys are allowed to do.
When you create an application, you choose one of two categories. This choice is permanent:
Operational: for integrations that read and write live data, such as orders, products, and availability.
Data: for read-only integrations, such as reporting and analytics tools.
⚠️ The category cannot be changed after creation. If you need a different category, create a new application.
2. Create an application and your first key
📌 How to access: app.smeetz.com > Settings > Account details > API keys
Click Create application.
Give your application a clear, unique name that describes the integration (for example "Website checkout", not "Test 1").
Select the category: Operational or Data.
Select the domains the application needs (see section 3).
Confirm to generate your first key.
New keys are always issued as test keys first. Test keys start with the prefix smtz_test_ and only work against test data, so you can build and validate your integration safely before going live.
[Screenshot: Create application wizard with category and domain selection]
3. Set domain permissions
Domains define which parts of your Smeetz data a key can access. Only grant the domains your integration actually needs.
Operational applications can access operational domains (orders, products, availability, and others) with Read or Read and write access per domain.
Data applications can access data domains with Read access only.
To set a domain's access level, click the domain card to cycle through the levels: not selected, Read, then Read and write. Click again to remove it.
✅ Best practice: start with Read only. Upgrade a domain to Read and write only when your integration needs to create or modify data.
[Screenshot: Domain cards showing Read and Read and write access levels]
4. Reveal and store your key securely
For your security, Smeetz never stores your full key. It is shown once, immediately after creation.
After generating the key, click Reveal key.
Confirm that you understand the key will not be shown again.
Copy the key and store it in a secure location, such as a password manager or your system's secret store.
⚠️ If you lose a key, it cannot be recovered. You will need to renew it, which generates a new key.
To use the key, your integration sends it in the x-public-api-key header of every API request.
6. Revoke a key
Revoke a key immediately if it has been exposed or the integration is no longer used.
Open the application and click Revoke key.
Confirm the revocation.
⚠️ Revocation is immediate and permanent. Any integration still using the key will stop working right away. There is no grace period.
You can also archive an application you no longer need, which removes it from your active list.