How to Generate a UPCS API Key

An API key identifies your business to UPCS. The plugins read it from their settings page, and custom code sends it in the x-api-key header. You create keys in the partner panel after you have a partner account.

Generate a key

1. Sign in to the partner panel with your partner email and password. If you have just registered, you are already there, and your first key has been created for you.
2. Find the API keys card.
3. In the optional New key name field, enter a name that says where the key will be used, for example the site or store name.
4. Choose Generate API key. One key is created each time you choose it, up to the limit shown on the card.
5. The key appears in the list, partly hidden. Use Show key and Copy to reveal and copy it. It starts with upcs_. Store it somewhere safe, such as a password manager or your server's secret configuration.

Where to use it

• In a store plugin, paste it into the plugin settings and run the connection test. See the WordPress plugin settings as an example.
• In custom code, send it with each server request:

curl -X POST https://api.upcs.io/api/v1/embed/sessions \
  -H "x-api-key: upcs_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"origin":"https://shop.example.com"}'

Handle the key like a password

• Never place it in page source, mobile app bundles or public repositories.
• Do not share one key between unrelated sites; see naming and separating keys.
• If you think a key has leaked, disable or delete it and generate a replacement.

Limits

Each key has an hourly request limit, 1,000 requests per hour by default. See the hourly request limit for how this affects your integration.

Before you move on

Write down which site or integration the key belongs to, and who on your team is responsible for it. When a key is documented from the start, rotating or retiring it later is quick and nobody has to guess which systems depend on it. A short note in your password manager entry is enough.