API keys
Mint and manage API keys from your CardNexus account at Settings → API keys.
Mint a key
- Sign in at cardnexus.com.
- Open Settings → API keys.
- Click Create key.
- Give it a name. The name is for your own bookkeeping — pick something that identifies the integration ("Alphabay POS sync", "PriceWatch bot").
- Pick the scopes the integration needs.
- Submit.
The full token is shown once. Copy it immediately. CardNexus never displays it again — if you lose it, revoke the key and mint a new one.
Listing keys
The Settings panel lists every key on your account: name, prefix (e.g. cnk_live_4f2d…), scopes, last-used timestamp, creation date.
Last-used updates coarsely — a key in continuous use sees its timestamp move every few minutes, not every request.
Revoking
Click Revoke on a key. Revocation is immediate: the next request authenticated with that key returns 401 Unauthorized. There's no grace period.
Revoked keys stay listed (greyed out) for audit purposes. They can't be un-revoked — mint a new key if you change your mind.
Choosing scopes
Common pairings:
| Integration | Scopes |
|---|---|
| Inventory sync (read existing stock, write changes) | inventory:read, inventory:write |
| Read-only price-watch | pricing:read, inventory:read |
| Order fulfilment automation | sales:read, sales:write, messaging:read, messaging:write |
| Buyer-side analytics | purchases:read, account:read |
| Basket building (browse listings, fill the cart) | cart:read, cart:write |
The wildcard * is full access — trust the script you're putting it in.
Security
A leaked key gives whoever holds it the same access your integration has. Treat it like a password:
- Don't commit keys to source control.
- Don't paste them in chat or tickets.
- Rotate (mint new, deploy, revoke old) when staff with access to the secret leaves.
- Use one key per integration so you can revoke surgically.