When you need one
Most stores never do. Rules are edited in the app, and import and export covers bulk changes.
An API key earns its place when another system already owns the number. If your ERP knows the case size, or your inventory system knows what is safe to sell this week, having it write that number into a rule directly is more reliable than someone remembering to mirror it by hand every Monday.
For reacting to events rather than pushing values, Automations is usually the better fit and needs no code at all.
What the section does
| Action | What happens |
|---|---|
| Create key | Name it, then copy the plaintext token shown once |
| View keys | Name, a masked version of the key, when it was created and when it was last used |
| Revoke | Disables that key immediately and permanently, with no confirmation step |
| Write log | Every write made through any key: when, which key, what action and its status |
The last-used column is the quiet useful one. A key that has not been used in months is either a dead integration or a leak nobody noticed, and both are worth revoking.
Create a key
Open Settings > API keys and click Create key.
Name it after the integration that will use it, such as "ERP sync", not "key 1". The name is what you will be reading in the write log later when something unexpected changes a rule.
Copy the token. This is the only time it is shown in full. Prime MOQ keeps only a hash of it afterwards, so a lost token cannot be recovered, only replaced.
Store it in a password manager or a secrets vault, not a shared document and not the integration's source code.
Use it in your integration's requests to the rules API.
Replace or revoke a key
There is no regenerate. Replacing a key means creating a new one and moving the integration onto it.
For zero downtime, create the new key first, update the integration, confirm it is working from the last-used column, and only then revoke the old one. Revoking first means every request from that integration starts failing immediately, and there is no undo and no confirmation dialog to catch a misclick.
Common mistakes
- Closing the dialog before copying the token. It is shown once. Closing it early means starting over with a new key.
- One key shared across several integrations. The moment you need to cut off one of them, you have to break all of them.
- Putting a key in client-side code or a public repository. It reads and writes your rules. Treat it as a password.
- Revoking before switching over. Do it in the other order.