Skip to main content

Create and manage partner keys

A partner key is a top-level credential that lets a developer act across several linked accounts under one integration — the pattern used for multi-account rollouts and white-label deployments. Unlike a standard API key scoped to a single account, a partner key can address any account in its group, so it is powerful and must be issued, stored, and rotated with care.

Before you begin​

  • Partner-level access. Partner keys are usually managed from an administration or developer settings area available only to partner or parent-account admins (confirm the exact location in your account).
  • A secure place to store the key value. It is typically shown only once at creation.
  • The list of accounts the integration must reach, and the scopes or permissions each key should carry.
  • A code path that reads the key from configuration or a secrets manager — never hard-coded in source or committed to version control.

Steps​

  1. Open the partner or developer settings area and start a new partner key. Give it a descriptive name that identifies the integration (for example, the app or environment it serves).
  2. Set the scope: choose which linked accounts the key may act on and which permissions it grants. Grant only what the integration needs.
  3. Generate the key and copy the full value immediately. Store it in your secrets manager; treat it like a password.
  4. Add the key to your integration's configuration and send it on requests using the authentication header your account documents (confirm the exact header and format in your account).
  5. To rotate, generate a replacement key, deploy it to your integration, verify traffic succeeds on the new key, then revoke the old one. This overlap avoids downtime.

Result​

Your integration authenticates across the intended accounts using the new key, and any revoked key is rejected. Confirm by making a low-risk authenticated call and checking that requests to in-scope accounts succeed while out-of-scope accounts are denied.

Canonical terms: Author, Edition, Folder (Project Folder), Broadcast. See the Glossary.