Skip to main content

​
API Key Management

Soku provides API keys that let you access the Public API programmatically. You can generate, view, and revoke API keys from the API Key Management page at /settings/api.

​
Accessing API Key Management

  1. Log in to your Soku dashboard at mysoku.io.
  2. Go to Settings in the main sidebar.
  3. Click the API tab (or navigate directly to /settings/api).

​
Generating a New API Key

  1. On the API Key Management page, click Generate New Key.
  2. Give your key a descriptive name (for example, “Production Server” or “Zapier Integration”).
  3. Click Create.
  4. Your new API key is displayed on screen.
Your API key is only shown once at the time of creation. Copy it immediately and store it in a secure location (such as a password manager or environment variable). You will not be able to view the full key again.

​
Key Format

Soku API keys follow this format:
All keys begin with the sk_live_ prefix, followed by a unique string of characters.

​
How Keys Are Stored

For security, Soku does not store your API key in plain text. When you create a key, the raw key is shown to you once, and then a SHA-256 hash of the key is stored on our servers. This means:
  • Soku can verify your key when you use it, but cannot retrieve the original key.
  • If you lose your key, you must revoke it and generate a new one.
  • Your key cannot be exposed even if our database were compromised.

​
Viewing Your Keys

The API Key Management page shows a list of all your active API keys, including:

​
Copying a Key

When you first generate a key, a Copy button is available next to the displayed key. Click it to copy the full key to your clipboard. After you leave the page or refresh, the full key is no longer available. Only the preview (first and last characters) is shown.

​
Revoking a Key

If a key is compromised or no longer needed:
  1. Go to Settings > API.
  2. Find the key in your list.
  3. Click Revoke.
  4. Confirm the revocation.
Once revoked, the key immediately stops working. Any API requests using the revoked key will receive a 401 Unauthorized response.
Revoking a key is permanent and takes effect immediately. Make sure any applications using the key are updated to use a new key before revoking the old one.

​
Using Your API Key

Include your API key in the Authorization header of every API request:
For full details on API authentication, see Authentication.

​
Best Practices

​
Troubleshooting

For more API troubleshooting, see API Troubleshooting.