What an API key is
An API key lets another system, like Zapier, your accounting tool or your own scripts, talk to sherlock for your company. You decide what each key can do. For example, a key can read your orders and nothing else.
How keys work
Section titled “How keys work”- A key belongs to your company. It only ever sees your company’s data. It can’t reach another company, even if someone changes the address it calls.
- A key does only what you allow. You pick its permissions when you create it, such as Read orders or Create inspections. Anything else is refused.
- You see the key once. sherlock shows the full key right after you create it and never again. We don’t keep a copy.
- You can revoke a key at any time. It stops working at once.
- Only company admins manage keys. Office staff and inspectors don’t see the API keys screen.
What a key can’t do
Section titled “What a key can’t do”Some things stay with people, so no key can be given them:
- Billing, subscriptions and payments
- Your team: adding people, changing roles, or reading their details
- Creating, listing or revoking API keys
- Anything about a single person’s account, like their profile or settings
A key also can’t hold more than the admin who created it.
Limits
Section titled “Limits”Each key can make 60 calls a minute. If it goes over, sherlock refuses calls until the minute is up. See Use your API key.