Autonnel v0.1.0
Get started

API keys

Generate Bearer tokens for the external API. Per-key writeAccess flag.

API keys authenticate requests to the external API at /api/v1.1/*. Each user can hold multiple keys, and each key independently controls whether write operations are permitted.

Creating a key

  1. Go to Settings → API Keys.
  2. Click New key.
  3. Enter a label to identify the key (e.g., “Zapier integration” or “Fulfillment webhook”).
  4. Choose whether the key has write access — see Write access below.
  5. Click Create.

The key value is shown exactly once in the confirmation dialog. Copy it before closing. Autonnel stores only a SHA-256 hash of the key; there is no way to retrieve the original value later.

Using a key

Pass the key in the Authorization header on every request:

GET /api/v1.1/orders HTTP/1.1
Authorization: Bearer <your-key-value>

All external API endpoints require this header. Requests without a valid key return 401 Unauthorized.

Write access

Each key has a writeAccess boolean flag set at creation time.

writeAccessAllowed methods
false (default)GET only
trueGET, POST, PUT, DELETE

Read-only keys are suitable for reporting integrations and monitoring. Write keys are needed for endpoints that create or mutate data, such as marking an order as delivered.

You cannot change writeAccess after a key is created. To change access level, revoke the key and create a new one.

Revoking a key

Click Revoke next to any key in Settings → API Keys. Revocation takes effect immediately — no cache delay. Any in-flight request that reached the server before revocation will still complete.

Key scope

A key’s effective permissions are the union of the creating user’s role features. If the user is later assigned a more restrictive role, keys created before that change retain the previous effective access until revoked and recreated.

Usage tracking

Every request authenticated with an API key is logged with:

  • Key ID (not the raw key value)
  • HTTP status code returned
  • Latency in milliseconds

Logs are visible in the API key detail view and are useful for debugging integration failures.

Key storage details

The full key value is never stored. Only a display prefix (first 8 characters) and a SHA-256 hash are retained. The display prefix lets you identify which key is which in the list without exposing the secret.

Caveats

  • Lost keys cannot be recovered. If you lose the key value, revoke it and create a new one.
  • Keys are user-scoped. The effective permissions come from the creating user’s roles. Deleting a user also deletes all their keys.
  • Do not commit keys to source code or version control. A key is equivalent to a username and password for the external API. Store it in a secrets manager or environment variable.
  • writeAccess is immutable. You must revoke and recreate to change it.