API keys
Access: Settings → API keys
An API key is the password a program uses —your ERP, a connected spreadsheet, your own dashboard— to read your Epinium data without logging into the app. This screen is where you create them, change their permissions and cancel them.
This page explains the screen. To learn what information you can retrieve with a key and how to use it from a program, see the API guide.
Just want to connect an AI assistant?
You don't need to create a key at all. Go to Settings → MCP and authorise the assistant from your browser.
Requests consume credits
Every API call spends credits from your account, the same ones the AI features use. The per-resource prices are in Settings → Credits, under Public API and MCP connector.
Two things that save you trouble: you are only charged for what is delivered, so a call that fails spends nothing; and in metrics requests what costs is the date range, not the number of rows. If you run out of credits, the call is rejected before it runs and the response tells you what to shorten.
The details of the cost headers and of that error are in the API guide.
Creating a key
- Click Create API key
- Give it a name that reminds you what it is for (for example, ERP integration): it is the only thing you will see later to tell keys apart
- Tick the permissions it needs
- Save and copy the secret that appears
- Paste it into the tool that will use it
The secret is shown only once
When you create the key its full value is shown a single time. Once you close the window it cannot be recovered, neither from Epinium nor from support.
The permissions
Each key carries the permissions you tick, and reaches only what those permissions open. Tick the minimum the integration needs: if it needs more tomorrow, you add them without changing the key.
| Permission | Lets it read |
|---|---|
| Catalogue (read) | Your products, brands, countries and clusters |
| Campaigns (read) | Campaigns, ad groups, targets, product ads and search terms |
| Connections (read) | The Amazon accounts connected to Epinium |
| Tasks (read) | Epinium tasks and their suggestions |
| Skills (read) | Epinium's catalogue of marketing playbooks |
| Workflows (read) | Your automations, their configuration and which campaigns they reach |
| Workflows (write) | On top of reading them, change the configuration of your automations |
A key with no permissions ticked cannot read anything.
What you see in the table
| Column | What it tells you |
|---|---|
| Name | The one you gave it when creating it |
| Prefix | The first few characters of the secret. They let you recognise a key when you have several, without revealing the rest |
| Permissions | What that key reaches |
| Last used | When it was last used. If it says Never used, nobody has managed to connect it |
| Created | The date it was issued |
The Last used column is the quick way to find forgotten keys: one that has gone unused for months is almost always surplus, and every live key is one more open door.
Changing a key's permissions
You can edit an existing key and tick or untick permissions. The change applies instantly and the key stays the same: there is nothing to update wherever you have it configured.
This is the better way to widen or narrow an integration's reach, because it avoids generating a new secret and distributing it all over again.
Revoking a key
Revoking cancels the key for good. Any integration using it stops working immediately, so it pays to know who uses it first: the Last used column and the name you gave it are the clue.
A revoked key cannot be reactivated. If the integration has to work again, create a new one and replace the secret wherever it was set.
If you lose the secret
It cannot be recovered. The only way out is to revoke the key and create another, then change the secret in the tool that was using it.
That is why it is worth saving it in your team's password manager as soon as you create it, rather than in an email or a chat.
If you are an agency
This section appears in your own agency account too, like MCP and unlike Connections. And where you create the key changes its reach:
- Created in your agency account, the key is yours and reaches the accounts your clients have shared with you. Every request has to say which one it operates on.
- Created inside a client's account, the key belongs to that client and reaches only their connections.
If what you want is to connect an AI assistant, you need no key at all — see Settings → MCP.