API Keys Overview
API keys are used to authenticate your requests to the THEITBULLS API. Each API key is associated with a specific account and has configurable permissions.
Security: Never expose your API keys in client-side code or public repositories. Always use environment variables or a secrets manager.
Types of API Keys
| Type | Prefix | Purpose |
|---|---|---|
| Test Key | sk_test_ |
For development and testing in sandbox environment |
| Live Key | sk_live_ |
For production usage with real data |
Generating API Keys
- Log in to your THEITBULLS dashboard
- Navigate to Settings → API Keys
- Click Generate New Key
- Choose key type (Test or Live)
- Set permissions (Read, Write, Admin)
- Click Generate and copy your key
- Store the key securely (it won't be shown again)
Best practice: Generate separate keys for development, staging, and production environments.
Using API Keys
Include your API key in the Authorization header of every API request:
# Example: Using API key curl -X GET https://api.theitbulls.com/v1/account \ -H "Authorization: Bearer sk_live_abc123" \ -H "Content-Type: application/json"
SDK Example
# JavaScript (Node.js) const { TheitbullsClient } = require('@theitbulls/api'); const client = new TheitbullsClient({ apiKey: 'sk_live_abc123' });
API Key Permissions
| Permission | Allowed Actions |
|---|---|
| Read | GET requests only (view data) |
| Write | POST, PUT, DELETE requests (modify data) |
| Admin | All actions including user management |
API Key Rotation
Regularly rotating your API keys is a security best practice. Follow these steps:
- Generate a new API key
- Update your applications to use the new key
- Verify everything is working
- Revoke the old API key
Important: Revoking an API key will immediately invalidate all requests using that key. Ensure all applications are updated first.
Revoking API Keys
To revoke an API key:
- Go to Settings → API Keys in your dashboard
- Find the key you want to revoke
- Click Revoke or Delete
- Confirm the action
Security Alert: If you suspect a key has been compromised, revoke it immediately and generate a new one.
Best Practices
- Use environment variables for API keys
- Never commit keys to version control
- Use separate keys for different environments
- Assign minimum required permissions
- Rotate keys regularly (every 30-90 days)
- Monitor API key usage in your dashboard
- Use a secrets manager for production deployments
Need help with API keys? Our team is here to assist.
Get Support