The account key

Where it is issued, what to do when it gets lost, and the difference between revoking and deleting.

The API key is what connects a store to your account. It is what the module introduces itself with, and what it gets back the store identity, the search engines and the public key the search panel uses in the browser.

The account is born without one

And that is on purpose. A key only exists in full at the instant it is issued: we keep enough to recognise it, never the complete value. A key created at registration would reach the panel already unreadable, and nobody would be able to copy it.

Issuing

In Store profile → Integrations, the issue button asks for a name and nothing else. Give it one that says where it will be used from, store-production or staging, because that is what you will be reading six months from now when you have three.

The complete value (bk_live_…) appears only once, right after creating it. Copy it at that moment and paste it into the module. The list then shows only the prefix and the date it was last used.

Warning Nobody can show you a key again, us included. If you lose it before pasting it, the way out is to issue another.

Revoke, reactivate, delete

Each key in the list has three destinations, and the consequences are not the same:

• Revoke cuts off, immediately, anything that was using it. The store stops indexing and search stops answering for it.
• Reactivate undoes the revocation, with the same value as before. It is the button next to it, and it is why revoking is the first sensible reaction to a suspicion: it stops everything and does not force you to touch the module.
• Delete has no way back, because the value is not stored anywhere. If you delete the key the store uses, you have to issue another and paste it into the module again.

When should I change it

• Someone who had access to the store back office has left the team.
• The key went through a channel you do not control (a forwarded email, a supplier ticket, a screenshot).
• You are setting up a pre-production environment: give it a key of its own, so you can revoke that one alone.

The way is always the same: issue the new one, paste it into the module, confirm that the store is still indexing, and only then revoke the old one. In this order there is not a single minute of store downtime.

What the key is not

The API key belongs to the store server and not to the browser. The search panel running on the pages uses a public search key, a different one, which the handshake hands to the module and which only serves to read results. One never replaces the other, and the API key should not show up in any code that reaches the visitor.