API Keys & Least Privilege
Create, protect and revoke scoped keys without exposing them to visitors.
Content and code last checked 2026-10-06 by ConsentEase product documentation. This is a review of the written content and code, not a test on a live third-party platform.
Create a key
Open Settings → API Keys in the account that owns the integration. Give the key an identifiable purpose and choose only the scopes needed. Copy the full ce_live_… value when shown; it is displayed once.
Scopes
| Scope | Access |
|---|---|
| sites:read | Authorised websites, inventories, records, reports and installation checks |
| sites:scan | Explicit cookie rescans |
| sites:write | Website setup and creation, and cookie additions |
| consent:write | REST consent recording, metered; no MCP tools |
| * | Broad existing surface; not arbitrary account administration |
New keys default to sites:read only. A key does not bypass website ownership/agency authorisation. Adding write access can create billable websites or change live inventory.
Authentication
Send either Authorization: Bearer YOUR_API_KEY or X-API-Key: YOUR_API_KEY. Browser dashboard/Clerk sessions are not a substitute for API/MCP authentication.
Store safely
Keep keys in your backend's secret store or client-supported protected credential configuration. Never put them in public HTML, VITE_ variables, URLs, prompts, screenshots or committed files. The website's public banner ID is a different, non-secret identifier.
Revoke and rotate
Revoke unused/exposed keys in the dashboard. Replace dependent integration credentials and test with the smallest permitted read before resuming writes. Existing exports or provider data are not erased by revocation.
Do not share an owner's wildcard key simply to get discovery working.