Name and Separate API Keys for Each Site

Keys are cheap to create and painful to untangle later. If you name them clearly and give each site its own, you can see at a glance which key belongs to what, and you can switch one off without breaking anything else.

A naming scheme that works

Include three things in the name: the site or store, the environment and the integration type.

• acme-shop-production-woocommerce
• acme-shop-staging-woocommerce
• acme-portal-production-custom

Avoid names like "test" or "new key". Six months on, nobody knows what they were for.

Create a key per site

1. Generate an API key in the partner panel.
2. Enter the descriptive name when you create it.
3. Put the key only in that site's plugin settings or server secrets.
4. Register that site's address under allowed origins if it uses the embedded map.

Rotate keys on a schedule

Rotation limits the damage from an unnoticed leak.

1. Generate a replacement key with a similar name.
2. Update the site and confirm it works.
3. Disable or delete the old key.

Why separate keys help

• Isolation. A problem on one site does not take the others offline.
• Limits. The hourly request limit applies per key, so a busy site cannot use up another site's allowance. See the hourly limit.
• Clarity. A key that appears in an unexpected place is easy to spot when each one has a single home.

If you decide a shared key is acceptable for your situation, one key for every integration explains the trade-offs.