API Keys

The cryptographic token that identifies your systems when interacting with Cord.

How Keys Work

Every programmatic request to the Cord API requires an API Key. You can manage, revoke, and monitor their usage from the API tab of the Cord Workbench — the “Developers” bar at the bottom of the app, which appears once you turn on Developer mode at the bottom of the Settings index.

For security, Cord’s systems store your API Key as an irreversible Hash (sha-256). The plain text key (the string starting with sk_... or pk_...) will only be shown to you once upon creation. If you lose it, there is no way to recover it; you must revoke it and generate a new one.

Security Best Practices

Do not commit secret keys to repositories

Never commit (e.g., in Git) a key starting with sk_live_. If a public repository exposes your key, anyone can use it with the same permissions as your backend until you manually revoke it from the Workbench — Cord does not detect or suspend it for you. Use environment variables (like unversioned .env files) on your servers, and check the key’s activity log if you suspect it leaked.

Use the correct scope (Publishable vs Secret)

• Secret Keys (sk_): Have full read and write access to your finances and clients. They should only live on backend servers under your control.
• Publishable Keys (pk_): Designed to be safely injected into web applications (frontend). Cord will automatically apply restrictions on what these keys can see or hide sensitive fields (such as the cost/margin of products) when receiving a request signed with them.

Real-Time Activity

The Logs tab of the Workbench is a live audit log of every key’s usage: filter by method or status class, search by route, and select any request to see which IP, which key, and which flow (REST API or MCP) originated it. MCP calls show up with the tool that was invoked, for example /mcp/tools/call:listar_productos.