API Keys Overview
API keys are used to authenticate your requests to the THEITBULLS API. Each API key is associated with a specific account and has configurable permissions.
Security:
Never expose your API keys in client-side code or public repositories. Always use environment variables or a secrets manager.
Types of API Keys
| Type | Prefix | Purpose |
|---|---|---|
| Test Key |
sk_test_
|
For development and testing in sandbox environment |
| Live Key |
sk_live_
|
For production usage with real data |
Generating API Keys
- Log in to your THEITBULLS dashboard
- Navigate to Settings → API Keys
- Click Generate New Key
- Choose key type (Test or Live)
- Set permissions (Read, Write, Admin)
- Click Generate and copy your key
- Store the key securely (it won't be shown again)
Best practice:
Generate separate keys for development, staging, and production environments.
Using API Keys
Include your API key in the
Authorization
header of every API request:
# Example: Using API key
curl
-X GET https://api.theitbulls.com/v1/account \ -H
"Authorization: Bearer sk_live_abc123"
\ -H
"Content-Type: application/json"
SDK Example
# JavaScript (Node.js)
const
{ TheitbullsClient } =
require
(
'@theitbulls/api'
);
const
client =
new
TheitbullsClient({ apiKey:
'sk_live_abc123'
});
API Key Permissions
| Permission | Allowed Actions |
|---|---|
| Read | GET requests only (view data) |
| Write | POST, PUT, DELETE requests (modify data) |
| Admin | All actions including user management |
API Key Rotation
Regularly rotating your API keys is a security best practice. Follow these steps:
- Generate a new API key
- Update your applications to use the new key
- Verify everything is working
- Revoke the old API key
Important:
Revoking an API key will immediately invalidate all requests using that key. Ensure all applications are updated first.
Revoking API Keys
To revoke an API key:
- Go to Settings → API Keys in your dashboard
- Find the key you want to revoke
- Click Revoke or Delete
- Confirm the action
Security Alert:
If you suspect a key has been compromised, revoke it immediately and generate a new one.
Best Practices
- Use environment variables for API keys
- Never commit keys to version control
- Use separate keys for different environments
- Assign minimum required permissions
- Rotate keys regularly (every 30-90 days)
- Monitor API key usage in your dashboard
- Use a secrets manager for production deployments
Need help with API keys? Our team is here to assist.
Get Support