What is a scoped API key?
A scoped API key is a key that is only allowed to do specific things, such as read orders but not issue refunds, so that if it leaks, the damage is limited to what that scope allowed.
Least privilege API keys
The principle of least privilege says every credential should have the minimum access its job needs. API key scopes list exactly which endpoints or actions a key may use: a key for a reporting dashboard needs read access, not write access.
Scoped key vs master key
A master key can do anything the account can do. It is convenient and dangerous: one leaked key in a public repository or a browser bundle exposes everything. Scoped keys turn a leak from an incident into an inconvenience.
Setting API key permissions
- Create one key per integration or service, not one shared key.
- Grant the narrowest scope that works, and add more only when needed.
- Give every key an owner and a description, so unknown keys can be removed safely.
- Never put a secret key in client-side code.
How to rotate API keys
Issue a new key, deploy it alongside the old one, confirm traffic has moved, then revoke the old key. Rotate on a schedule, and straight away when someone with access leaves or a key may have leaked. Micro SaaS API Marketplace issues keys per subscriber, each carrying its own limits, so one customer’s key never affects another’s.
Last reviewed 2026-11-01.