API Key Management

API Key Management allows you to create, manage, and monitor keys for accessing platform APIs, enabling automated integration and programmatic access.

Overview

Core Features

• Key Generation - Create API keys with different permissions
• Permission Control - Fine-grained permission management
• Usage Monitoring - Track API key usage
• Rate Limiting - Control API call frequency
• Security Management - Key revocation and expiration

API Key Statistics

The top of the API Key Management page displays key usage overview:

📊 Key Overview

• Total Keys - Total number of API keys created
• Active Keys - Currently valid keys
• Expired Keys - Keys that have expired
• Revoked Keys - Keys that have been revoked

📈 Usage Statistics

• Total Requests - Cumulative requests across all keys
• Monthly Requests - API calls this month
• Average Response Time - Average API response speed
• Error Rate - Percentage of failed API calls

Create API Key

Basic Information

Click "Create API Key" to start:

Key Name

• Name - Identifiable key name (required)
• Description - Purpose description (optional)

Expiration Settings

Choose the validity period:

• Never Expires - Long-term validity (not recommended)
• 30 Days - Short-term testing
• 90 Days - Temporary projects
• 180 Days - Six-month validity
• 1 Year - Long-term projects
• Custom - Specify expiration date

💡 Security Tip: For security reasons, set a reasonable expiration time and rotate keys regularly.

Permission Configuration

Select API key access permissions:

Read-only Permission (Read)

Allows reading data but not modifications:

• ✅ Get site list
• ✅ View analysis reports
• ✅ Read keyword data
• ❌ Create/modify/delete resources

Use Cases:

• Data display dashboards
• Report system integration
• Monitoring and alerting systems

Write Permission (Write)

Allows creating and modifying resources:

• ✅ All read permission features
• ✅ Create new sites
• ✅ Add keywords
• ✅ Upload data sources
• ❌ Delete resources

Use Cases:

• CMS integration
• Automated content publishing
• Batch data import

Full Permission (Full)

Has all operation permissions:

• ✅ All read permissions
• ✅ All write permissions
• ✅ Delete resources
• ✅ Modify settings

Use Cases:

• Administrator automation scripts
• Complete system integration
• Development and testing environments

⚠️ Warning: Full permission keys have the highest privileges. Keep them secure and only use when necessary.

Security Best Practices

Key Storage

✅ Recommended Practices

1. Environment Variables

   # .env file
   SOLOKIT_API_KEY=sk_live_your_api_key_here
   

2. Key Management Services

   • AWS Secrets Manager
   • Azure Key Vault
   • HashiCorp Vault
   • Google Secret Manager

❌ Prohibited Practices

1. Hardcoding in Code

   // ❌ Don't do this
   const apiKey = 'sk_live_abc123...';
   

2. Committing to Version Control

   # ❌ Don't commit files with keys
   git add .env
   

Permission Minimization

Follow the principle of least privilege:

• 📖 Read-only for read scenarios - Use Read when write permission not needed
• ✏️ Write for write scenarios - Use Write when delete permission not needed
• 🔐 Avoid over-authorization - Don't default to Full permission
• 🎯 Assign keys per application - Each application uses independent keys

Use Cases

CI/CD Integration

Use in continuous integration/deployment workflows:

# GitHub Actions example
name: Deploy
on: [push]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      
      - name: Run SEO Analysis
        env:
          SOLOKIT_API_KEY: ${{ secrets.SOLOKIT_API_KEY }}
        run: |
          curl -X POST https://api.solokit.com/v1/sites/analyze \
            -H "Authorization: Bearer $SOLOKIT_API_KEY" \
            -H "Content-Type: application/json" \
            -d '{"site_id": "site_123"}'

FAQs

How to recover a lost API key?

Cannot recover. For security reasons, the system doesn't store complete keys. If lost:

1. Revoke the lost key
2. Create a new key
3. Update the key in applications

Can API keys be shared?

Not recommended. Each application or user should have independent keys, which:

• Makes tracking usage easier
• Allows independent permission management
• Limits impact when issues occur
• Makes handling personnel changes easier

Related Resources

• Site Management - Manage your websites
• Automation - Set up automated tasks
• Agent Management - Configure AI agents

Next Steps

• Set up Automation for automated tasks
• Manage Team API access permissions