Issuing and revoking partner API keys
The admin API Keys tab — platform-wide Partner API usage, every organisation's keys, issuing a key on an organisation's behalf, and revoking keys.
Internal · platform adminsLast updated Internal
On this page
Internal
This page is for ShowTix platform admins only. These screens are not visible to hosts.
Platform Admin → API Keys (/admin/api-keys) shows Partner API traffic across the whole platform and every organisation's API keys. You can issue a key for any organisation and revoke any key.
Organisation owners and admins normally create their own keys under Developers — see Developers dashboard. How partners use a key is in Authentication.
Usage#
Pick a range with 24h, 7d or 30d (default 7d). The stat strip shows:
Partner API requests, with the error count underneath
Error rate
p95 latency
Active keys
Organisations calling — organisations that made requests in the range, with how many hold active keys underneath
Below that, Requests across all organisations charts successful requests and errors over time, and Top organisations ranks organisations by request count. Click an organisation in Top organisations to filter the key list to its keys.
All API keys#
Filter the list with:
Name or key prefix — matches the key name, the organisation name or the key's visible prefix
Any organisation — pick one organisation
All / Active / Revoked — Revoked also includes expired keys
The table shows each key's Name, Organisation, Mode, Permissions, Last used and Status. Keys issued by a platform admin carry a shield icon with the tooltip Issued by ShowTix — the organisation's own owners see the same marker in their Developers area.
Issuing a key for an organisation#
Open the form
Click Issue key. The Issue API key dialog notes that the organisation's owners will see the key marked as issued by ShowTix. If you've already filtered to one organisation, it's filled in for you.
Fill in the details
Organisation — search by name or slug. Deleted organisations can't be chosen.
Name — up to 80 characters, e.g. "Venue website, CRM sync".
Mode — Test or Live. Test reads real data, but writes are dry runs: nothing is held, issued or checked in. Live makes real holds, orders and check-ins. Mode can't be changed later.
Permissions — at least one (see the table below). Select all and Clear all are there to help.
IP allowlist (optional) — IP addresses or CIDR ranges, up to 50. Requests from anywhere else are rejected with
ip_not_allowed. Leave it empty to allow all.Rate limit (optional) — requests per minute. Leave it empty for the default: 120 for live keys, 60 for test keys.
Issue it
Click Issue key.
Copy the secret
The Key issued dialog shows the secret once. Use Show secret or the copy button, tick I've saved this somewhere safe — I understand it won't be shown again., then click Done.
Send the secret to the organisation over a secure channel. ShowTix only stores a hash of it, so nobody — including platform admins — can see the full key again. Afterwards it's displayed as its prefix and last four characters. Live keys start stx_live_ and test keys start stx_test_.
The rate limit field accepts values above 6,000, but the server rejects anything over 6,000 requests per minute. Keep it at 6,000 or lower.
Permissions#
| Permission | Allows |
|---|---|
events:read | Read events, ticket types and venues |
orders:read | Read orders, tickets and checkout sessions |
orders:write | Create checkout sessions and issue comp tickets |
attendees:read | Read attendee lists |
check_in:write | Check tickets in at the door |
webhooks:manage | Manage webhook endpoints through the API |
Revoking a key#
Click Revoke on the key (revoked and expired keys have no actions).
The Revoke this key? dialog warns that the key stops working immediately and that this can't be undone.
Click Revoke key.
To replace a revoked key, issue a new one.
Not available yet here#
Editing, rolling (rotating) or renaming a key isn't available on the admin page — an organisation's owners and admins can do those from their own Developers area.
Was this article helpful?