Skip to content
ESEN

API Keys

The cryptographic token that identifies your systems when interacting with Cord.

How Keys Work

The Workbench API keys tab in full screen: at the top, 3,412 of 5,000 API requests used this month and version 2026-10-01; below, secret, restricted and publishable keys in live and test mode, each with its masked token and last 4 characters, permissions, last use, creation and expiration date, plus an OAuth connection and a revoked key.

Every programmatic request to the Cord API requires an API Key. You can manage, revoke, and monitor their usage from the API keys tab of the Cord Workbench — the “Developers” pill in the bottom-right corner of the app, which appears once you turn on Developer mode in Your account › Preferences.

For security, Cord’s systems store your API Key as an irreversible Hash (sha-256). The plain text key (the string starting with sk_..., rk_... or pk_...) will only be shown to you once upon creation. If you lose it, there is no way to recover it; you must revoke it and generate a new one.

Identity confirmation

Creating or rolling a key, and changing its permissions, its allowed IPs or its MCP tools, asks you to confirm your identity with your password, or with the code from your authenticator app if your account doesn’t use a password. The confirmation lasts 10 minutes. A key keeps working even after the session that created it ends, so Cord doesn’t let a session that nobody confirmed recently create one. If your account has neither a password nor a verification code, sign out and sign back in: signing in counts as confirmation for those 10 minutes. Renaming or revoking a key doesn’t ask for it.

Security Best Practices

Do not commit secret keys to repositories

Never commit (e.g., in Git) a key starting with sk_live_. If a public repository exposes your key, anyone can use it with the same permissions as your backend until you manually revoke it from the Workbench — Cord does not detect or suspend it for you. Use environment variables (like unversioned .env files) on your servers, and check the key’s activity log if you suspect it leaked.

Use the correct scope (Publishable vs Secret)

  • Secret Keys (sk_): Access the whole API, read-only or read and write depending on the scope you choose when creating them. They should only live on backend servers under your control.
  • Restricted Keys (rk_): Also server-side, but with a permission per resource (none, read, or write). See restricted keys.
  • Publishable Keys (pk_): Designed to be safely injected into web applications (frontend). Cord will automatically apply restrictions on what these keys can see or hide sensitive fields (such as the cost/margin of products) when receiving a request signed with them.

Real-Time Activity

The Logs tab of the Workbench is a live audit log of every key’s usage: filter by method or status class, search by route, and select any request to see which IP, which key, and which flow (REST API or MCP) originated it. MCP calls show up with the tool that was invoked, for example /mcp/tools/call:listar_productos.