Skip to main content

API keys

API keys let external systems work with your Traceable account programmatically. They authenticate the Integration API, which lets ERP, PLM, and other software author Digital Product Passports without using the portal.

You manage keys in Settings → API Keys.

Live on production

The Integration API is live on production as of 29 June 2026. Create a key here, store its key and signing secret, and point your integration at it. Full technical reference: Integration API.

What API keys are used for​

An Integration API key lets a connected system:

  • Create Digital Product Passport drafts from your product data
  • Update draft fields as data becomes available
  • Upload evidence documents (test reports, certificates, declarations)
  • Check the publish gate to see what data is still missing
  • Submit a completed draft to your review queue

The API never publishes. A submitted passport always goes to a human reviewer in the portal, who publishes it. See Regulatory boundary.

Scopes​

Each key carries one or more scopes. A scope grants a specific capability, and a key can only do what its scopes allow. You choose the scopes when you create the key.

ScopeGrants
dpp:readRead your products and their details
dpp:draft:writeCreate and update draft passports
dpp:gate:readRead the publish gate report for a product
document:writeUpload evidence documents
dpp:submitSubmit a passport for review

Grant only the scopes an integration needs. There is no publish scope (publication is always a human action) and no AI scope.

Creating an API key​

  1. Navigate to Settings → API Keys.
  2. Click New key.
  3. Enter a descriptive name that identifies the system the key is for (for example odoo-prod, sap-erp, plm-integration).
  4. Select the scopes the integration requires.
  5. Click Create key.
  6. Copy both the key and the signing secret immediately. They are each shown only once, at creation time. After you leave this screen they cannot be retrieved.

You can hold up to 10 active keys per company.

The signing secret​

Every key is issued with a signing secret in addition to the key itself. The signing secret is used to sign write requests (a security measure that proves the request was not tampered with in transit).

  • The signing secret is shown once, when the key is created or rotated.
  • Traceable does not store it in a form it can show you again.
  • Store it in your secrets manager immediately.
  • If it is lost, rotate the key to generate a new one.

For how the signing secret is used, see Integration API: Authentication.

Storing keys securely​

An API key and its signing secret are credentials equivalent to a password. Treat them with the same care.

Do:

  • Store them in a secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) or in environment variables on the systems that need them.
  • Use one key per integration so that revoking one does not affect others.
  • Rotate keys periodically or whenever someone with access leaves your organisation.

Do not:

  • Commit keys or signing secrets to source control, even private repositories.
  • Share them over email, chat, or any unencrypted channel.
  • Put a key or secret in a URL, query string, log line, or error report.

Viewing key activity​

Each key has an Activity view, reached from the key row in Settings → API Keys. It shows every request made with that key, including:

  • The method and endpoint called
  • The response status and response time
  • The scope used and the request identifier
  • Field-level changes for write operations

Use the Activity view to confirm an integration is behaving as expected and to investigate unexpected usage. The activity log can also be exported to CSV for record-keeping.

If a key shows activity you do not recognise, revoke it immediately and investigate.

Rotating a key​

Key rotation replaces an existing key with a new one. Do this periodically, or whenever you suspect a key or signing secret may have been exposed.

  1. Create a new key with the same scopes (see Creating an API key).
  2. Update your integration to use the new key and its signing secret.
  3. Verify the integration works with the new key.
  4. Return to Settings → API Keys, find the old key, and click Revoke.

Do not revoke the old key before confirming the new key works, or your integration will fail during the transition.

Revoking a key​

To revoke a key immediately:

  1. Navigate to Settings → API Keys.
  2. Find the key in the list.
  3. Click Revoke next to the key name.
  4. Confirm the revocation.

Revocation is immediate and permanent. Any request made with a revoked key receives an HTTP 401 Unauthorized response. Revoked keys cannot be re-enabled.

Rate limits​

API requests are subject to rate limiting. If an integration exceeds the limit, requests receive an HTTP 429 Too Many Requests response. Back off and retry after a short delay. For the full developer reference, see the Integration API reference.