API Keys

Creating, storing, and revoking keys, and how scopes work.

API access is granted per account, not by plan

Unlike most Stynar features, API access isn't tied to a subscription tier — it's enabled individually per account by the Stynar team, with rate limits and quotas set specifically for that account. If Settings → API Access shows access as disabled, you don't have it yet.

Request access

Contact Stynar support and let them know you want to integrate with the API. They'll enable it for your account with limits that fit your use case.

Create a key

Go to Settings → API Access and click Create API Key. Choose a name and scopes (read and/or write).

Save it immediately

Your key is shown once, in full. Copy it somewhere secure — Stynar cannot show it to you again.

Use it as a Bearer token

Send it on every request as Authorization: Bearer esk_.... See Authentication.

Format

Authorization header

Authorization: Bearer esk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scopes

Field	Type	Required	Description
read	scope	Optional	View-only endpoints — every GET on this API.
write	scope	Optional	State-changing endpoints — POST, PUT, PATCH, DELETE.

Scopes are chosen at creation time and can't be changed afterward — create a new key with different scopes instead. A key can hold both scopes at once.

Revoking a key

Revoke a key from Settings → API Access at any time. Revocation takes effect immediately — every request checks the key live, never against a cache.

Never expose secret keys in browser or client-side code

A key sent from client-side JavaScript, a mobile app bundle, or any code a user can inspect is effectively public. Call the Stynar API from your backend, and keep the key in a server-side secret store — never in a repo, a frontend bundle, or a URL query string.