API Credentials

The API Credentials page under Administration shows the Dataset ID, Server URL, and API Credentials attached to the active Dataset.

Keep Credentials Secure

Store backend API Keys and OAuth Client Secrets in secure server-side configuration, never in source code.

Authentication Methods

Each API Credential uses one of two authentication methods: API Key or OAuth 2.0 (Client Credentials).

Use an API Key for browser applications or backend integrations. Send the key with each API request.

API Key credentials support permissions, allowed IP addresses, and allowed origins. For browser applications, configure allowed origins and grant only the permissions needed for browser operations. See Network Restrictions.

For authentication examples, see the SDK guides. To replace an API Key, see Regenerate a Credential.

The authentication method cannot be changed after a credential is created.

Use Separate Credentials

Create a separate credential for each application or integration, grant only the permissions it needs, and restrict its network access where possible.

Create a Credential

1. Under Administration -> API Credentials, select Create Credential.
2. Choose the Authentication Method and select Continue.
3. Enter a Name and Description.
4. Configure Permissions and any network restrictions under Advanced.
5. Create the credential.

For OAuth credentials, copy and securely store the Client Secret before closing the result dialog; it is shown only once. API Keys can be viewed and copied again through Edit. If you lose a Client Secret, regenerate it.

Permissions

Under Permissions, select only the operations your application needs. Expand permission groups to review their descriptions. Browser credentials should not have catalog-update or other administrative permissions.

Network Restrictions

Set restrictions under Advanced, pressing Enter to add each entry. An empty list leaves that type of access unrestricted; permissions still apply.

• Limit to origins applies to API Key credentials. Enter domains or subdomains such as shop.example.com, without a scheme, path, port, or wildcard. The restriction checks the Origin header when present, so it does not block requests that omit that header.
• Limit to IPs applies to both methods. Enter public outbound IPv4 addresses or patterns such as 192.0.2.*; CIDR notation and IPv6 are not supported. For OAuth, the restriction applies to both token requests and API requests.

Regenerate a Credential

Select Regenerate in the list and confirm. The credential's settings and permissions remain unchanged.

Method	Effect of regeneration
API Key	The old API Key stops working immediately, with no grace period.
OAuth 2.0 (Client Credentials)	The old Client Secret immediately stops working for new token requests. Existing access tokens remain usable until expiration, subject to the credential's current state and restrictions.

Plan the application configuration update before regenerating, then update every application using the old value. A new Client Secret is shown only once; copy and securely store it before closing the dialog. The Client ID does not change.

Delete a Credential

Select Delete under Edit and confirm. Deleting a credential blocks its access, including requests using existing OAuth tokens. Update or remove application references first. If an installed app uses the credential, resolve that dependency before deleting it.

Master API Key

The Master API Key is separate from the API Credentials you create. It uses Authorization: APIKey <api-key> and has broad Dataset access, including operations that create or delete Products and Content.

It cannot be updated, rotated, or deleted. Browser requests using it are rejected.

Select View beside Master API Key in My Relewise to view or copy it.

Use an API Credential Instead

Guard this key carefully. We recommend never using it in applications. Create an API Credential with only the permissions your application requires instead.