API keys
Access: Settings → API keys
An API key is the password a program uses —your ERP, a connected spreadsheet, your own dashboard— to read your Epinium data without logging into the app. This screen is where you create them, change their permissions and cancel them.
This page explains the screen. To learn what information you can retrieve with a key and how to use it from a program, see the API guide.
Just want to connect an AI assistant?
You don't need to create a key at all. Go to Settings → MCP and authorise the assistant from your browser.
Requests consume credits
Every API call spends credits from your account, the same ones the AI features use. The per-resource prices are in Settings → Credits, under Public API and MCP connector.
Two things that save you trouble: you are only charged for what is delivered, so a call that fails spends nothing; and in metrics requests what costs is the date range, not the number of rows. If you run out of credits, the call is rejected before it runs and the response tells you what to shorten.
The details of the cost headers and of that error are in the API guide.
Creating a key
- Click Create API key
- Give it a name that reminds you what it is for (for example, ERP integration): it is the only thing you will see later to tell keys apart
- Set the access level of each area: the key starts in read only, which is what almost any integration needs. If yours has to change something, raise that area to Edit
- Save and copy the secret that appears
- Paste it into the tool that will use it
The secret is shown only once
When you create the key its full value is shown a single time. Once you close the window it cannot be recovered, neither from Epinium nor from support.
The permissions
Each key reaches only the areas you open for it, at the level you give them. Give it the minimum the integration needs: if it needs more tomorrow, you raise it without changing the key.
| Area | What it opens |
|---|---|
| Catalog | Your products, brands, countries and keyword clusters, with their metrics. On Edit, creating keyword clusters, changing their keywords and products, and deleting them |
| Campaigns | Campaigns, portfolios, ad groups, targetings, product ads and search terms, with their metrics. On Edit, creating campaigns and portfolios and changing bids, budgets and state on Amazon |
| Connections | The Amazon accounts and the Shopify and WooCommerce stores connected to Epinium: what you have connected, not what it holds |
| Data from your connected stores and platforms | What is inside your Shopify and WooCommerce stores: products, stock, prices and the rest of what they expose, and the record of the changes made in them. It is what an AI assistant uses to query the store. On Edit, creating, editing and deleting products and content directly in the store, with no review first |
| Tasks | Epinium tasks and their suggestions. On Edit, creating tasks, approving or rejecting their suggestions and applying what was approved |
| CMO Brain | Epinium's catalogue of marketing playbooks |
| Workflows | Your automations, their configuration and the performance of the campaigns they optimize |
Each area is set to one of three levels: No access, View or Edit. Today Catalog, Campaigns, Data from your connected stores and platforms, Tasks and Workflows accept Edit, and Edit includes View: an integration that writes also reads.
Edit is for the Business and Master plans. On Free and Guru keys read and the Edit level shows as locked. If you move down to one of those plans, a key that already had Edit keeps working for reads, but its writes are refused.
Above them, two presets move every area at once: Full access and Read only. A key needs at least one permission: with none it would fail every call, so it cannot be saved that way.
What you see in the table
| Column | What it tells you |
|---|---|
| Name | The one you gave it when creating it, with the prefix underneath: the first characters of the secret, to recognise it without revealing the rest |
| Access | A one-label summary: Full access, Read only, Customized (a hand-picked combination) or No access in red, which means that key does not work |
| Last used | When it was last used. If it says Never used, nobody has managed to connect it |
| Created | The date it was issued |
The Last used column is the quick way to find forgotten keys: one that has gone unused for months is almost always surplus, and every live key is one more open door.
Changing a key's permissions
You can edit an existing key and raise or lower the level of each area. The change applies instantly and the key stays the same: there is nothing to update wherever you have it configured.
This is the better way to widen or narrow an integration's reach, because it avoids generating a new secret and distributing it all over again.
Revoking a key
Revoking cancels the key for good. Any integration using it stops working immediately, so it pays to know who uses it first: the Last used column and the name you gave it are the clue.
A revoked key cannot be reactivated. If the integration has to work again, create a new one and replace the secret wherever it was set.
If you lose the secret
It cannot be recovered. The only way out is to revoke the key and create another, then change the secret in the tool that was using it.
That is why it is worth saving it in your team's password manager as soon as you create it, rather than in an email or a chat.
If you are an agency
This section appears in your own agency account too, like MCP and unlike Connections. And where you create the key changes its reach:
- Created in your agency account, the key is yours and reaches the accounts your clients have shared with you. Every request has to say which one it operates on.
- Created inside a client's account, the key belongs to that client and reaches only their connections.
If what you want is to connect an AI assistant, you need no key at all — see Settings → MCP.