Skip to main content

API Keys

Purpose​

API keys allow external systems to call xTrakt APIs without using an interactive browser session.

Required Permissions​

Only trusted administrators or integration owners should generate, rotate, or revoke API keys.

Workflow​

  1. Open the API key management area.
  2. Generate a key for one integration or environment.
  3. Store the key in a secret manager or protected environment variable.
  4. Use the key in the Authorization header.
  5. Rotate keys on a regular schedule and after personnel or vendor changes.
  6. Revoke keys that are no longer used.

Security Considerations​

  • Do not commit API keys to source control.
  • Use different keys for development, staging, and production.
  • Prefer short-lived or rotated credentials when the product supports them.
  • Treat leaked keys as incidents and revoke them immediately.