API Keys
API keys (Permissions → API Keys) are credentials for external systems to call Gillie's interfaces. Each key has its own permissions, and their use can be restricted to teams and allowed interfaces.
Basic Information
- Name — a descriptive name for the key (required).
Signature Verification
- Require checksum — if this switch is on, calls must include the key’s checksum (hash). Recommended for production use.
Displaying the Key
When the key is saved, the following are shown:
- API Key — the public identifier sent in calls.
- Private Key — shown only when first created. Save this information securely immediately, as it cannot be displayed again.
Allowed Teams
- Allow all teams — the key can access all teams.
- If the switch is off, select the allowed teams from the list.
Allowed Interfaces
The Allowed Interfaces list contains interface paths or patterns (e.g., /api/v1/customers). The key may only call interfaces matching these.
Role Group and Permissions
Permissions are assigned to the key the same way as for a user: select the role group and roles the key will have.
Additional Functions
- Audit trail — change history of the key (permission admin_apikeys_audit).
- Test embedded — quick testing of the key directly from the admin view (visible only after saving).
- Delete — permanently removes the key.
Warning. The private key is shown only once. If the key is lost or leaked, delete the old key and create a new one.
Permission
Management requires the admin_apikeys permission.