API Key

Defines an API key to be used when calling Grooper API Services.

Remarks

The API Key object represents a unique credential used to authenticate and authorize access to API Services. Each API key is a GUID value, optionally accompanied by a description to identify its intended use, owner, or associated system.

API keys are the primary mechanism for controlling access to Grooper's API endpoints. They should be distributed only to trusted integration partners, applications, or users, and managed according to your organization's security policies.

How It Works

• Each client or integration partner is assigned a unique API Key.
• Clients must present their API key with each request to API Services.
• The service validates the key and grants or denies access accordingly.

Configuration and Usage

• Use the 'Description' property to document the purpose or owner of each key.
• Generate new keys as needed for new integrations or users.
• Revoke or rotate keys if they are no longer needed or if compromise is suspected.

Security Considerations

• Treat API keys as sensitive credentials; do not share them in unsecured channels.
• Combine API key authentication with HTTPS to protect keys in transit.
• Regularly audit and rotate API keys to maintain security.

Properties

Name	Type		Description
Description	String	►	A description of the entity or group using this API key. The 'Description' property provides a human-readable label for the API key, helping administrators track its intended use, owner, or associated system. This is especially useful in environments with multiple integration partners or applications, as it enables clear identification and auditing of API key usage. Examples: Invoice Import Service Partner: Acme Corp QA Automation Keeping this field up to date improves security and operational efficiency, especially when keys need to be rotated or revoked.
Key	Guid	►	The API key. The 'API Key' property is a globally unique identifier (GUID) that serves as the credential for authenticating requests to API Services. This value is generated automatically when a new API Key object is created. Distribute this value securely to the intended client or integration partner. Clients must include this key in their API requests to gain access. Treat the key as a secret; exposure may allow unauthorized access. If an API key is compromised or no longer needed, remove or regenerate it to maintain security.

Used By

API Services