# API Keys for Your Own Integrations

> Source: https://primemoq.app/help/settings/api-keys
> Collection: Settings
> Updated: 2026-08-26

Create a named API key so an ERP, an inventory system or a tool you build can read and write Prime MOQ rules without your Shopify admin login.

**Short answer.** Settings > API keys creates named keys that let your own integrations call Prime MOQ's rules API directly. The full key is shown once, at creation, because only a hash of it is stored afterwards. There is no regenerate, only Create and Revoke, and every write made through a key is logged with the key that made it.

## Key takeaways

- Pro plan only.
- The plaintext key is shown exactly once. Copy it before closing the dialog.
- One key per integration, so a single leak can be revoked without breaking everything else.
- Revoke is immediate, permanent and has no confirmation step.

## Before you start

- Somewhere safe to store a secret, such as a password manager or a secrets vault.

## When you need one

Most stores never do. Rules are edited in the app, and
[import and export](https://primemoq.app/help/settings/import-export) covers bulk changes.

An API key earns its place when another system already owns the number. If your
ERP knows the case size, or your inventory system knows what is safe to sell this
week, having it write that number into a rule directly is more reliable than
someone remembering to mirror it by hand every Monday.

For reacting to events rather than pushing values,
[Automations](https://primemoq.app/help/automations/automations-overview) is usually the better fit
and needs no code at all.

## What the section does

| Action | What happens |
| --- | --- |
| Create key | Name it, then copy the plaintext token shown once |
| View keys | Name, a masked version of the key, when it was created and when it was last used |
| Revoke | Disables that key immediately and permanently, with no confirmation step |
| Write log | Every write made through any key: when, which key, what action and its status |

The last-used column is the quiet useful one. A key that has not been used in
months is either a dead integration or a leak nobody noticed, and both are worth
revoking.

## Create a key

**Open Settings > API keys and click Create key.**

**Name it after the integration that will use it,** such as "ERP sync", not
"key 1". The name is what you will be reading in the write log later when
something unexpected changes a rule.

**Copy the token.** This is the only time it is shown in full. Prime MOQ keeps
only a hash of it afterwards, so a lost token cannot be recovered, only replaced.

**Store it in a password manager or a secrets vault,** not a shared document and
not the integration's source code.

**Use it in your integration's requests** to the rules API.

## Replace or revoke a key

There is no regenerate. Replacing a key means creating a new one and moving the
integration onto it.

For zero downtime, create the new key first, update the integration, confirm it
is working from the last-used column, and only then revoke the old one. Revoking
first means every request from that integration starts failing immediately, and
there is no undo and no confirmation dialog to catch a misclick.

## Common mistakes

- Closing the dialog before copying the token. It is shown once. Closing it
early means starting over with a new key.

- One key shared across several integrations. The moment you need to cut off
one of them, you have to break all of them.

- Putting a key in client-side code or a public repository. It reads and
writes your rules. Treat it as a password.

- Revoking before switching over. Do it in the other order.

## FAQ

### What can an API key actually do?

Read and write rules through Prime MOQ's own API, which is the same rule data you manage in the app. It is not a general key to your Shopify store.

### Is there a rate limit?

Yes, applied per key. The section's own hint text in the app carries the current figure, which is the version to trust rather than a number written down here.

### Can I see what a specific key has done?

Yes. The write log below the keys table records every write with the key that made it, the action, the time and the resulting status, so an unexpected change can be traced back to an integration.

### What happens to an integration using a revoked key?

Its requests start failing immediately. Revocation takes effect at once and cannot be undone, so create and switch to a replacement key before revoking the old one.

### Is this available on the free plan?

No. API keys are Pro only. On the free plan the section is visible but creating a key is locked.

**Best for:** Merchants keeping Prime MOQ rules in step with an ERP, an inventory system or a custom tool outside Shopify admin.

**Applies to:** Pro plan