> ## Documentation Index
> Fetch the complete documentation index at: https://docs.craveup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a Private Integration API Key

> Create and protect a server-only Crave credential for admin or partner integrations.

Public storefronts do not use API keys. Browser and mobile apps call `/api/v1/storefront` directly with anonymous published reads, cart capabilities, and customer JWTs.

Generate an API key only for a private admin, partner, or CLI integration that runs in a trusted server environment.

## Create the key

1. Open the [Dashboard Developers page](https://dashboard.craveup.com/dashboard/developers).
2. Sign in as an organization admin for the merchant account.
3. Create a key with a clear environment and service name.
4. Select only the permissions the server integration needs. Read and write permissions are
   independent; selecting write does not grant read.
5. Copy the token when it is shown, verify the displayed granted permissions, and put the token in
   the server platform's secret manager.

```env theme={null}
# Server process only. Never expose this through a public frontend prefix.
CRAVEUP_API_KEY=replace_with_secret
```

Send the token only in the private `X-API-Key` request header from your trusted server process.

| Permission                                 | Allows                                                     |
| ------------------------------------------ | ---------------------------------------------------------- |
| `merchant:read` / `merchant:write`         | Merchant and location settings reads or changes            |
| `catalog:read` / `catalog:write`           | Menu, product, modifier, and discount reads or changes     |
| `orders:read` / `orders:write`             | Order reads or lifecycle changes                           |
| `customers:read`                           | Customer reads and exports                                 |
| `integrations:read` / `integrations:write` | Provider/integration status reads or configuration changes |

Use separate credentials for development, staging, and production. Test deployments accept only
`crv_test_` keys and production accepts only `crv_live_` keys. A wrong-tier, expired, revoked, or
under-scoped key fails closed.

Keys created before explicit permissions were introduced may show no scopes and can no longer call
private scoped routes. Create a least-privilege replacement, update the consumer through its secret
manager, verify the replacement, and then revoke the old key. Rotate or revoke any key that is
exposed or no longer used. Expired and revoked keys do not count toward the active-key limit. If
three active keys already exist, use the fourth slot only for replacement overlap and return to no
more than three after cutover.

<Warning>
  Never embed a private integration key in browser JavaScript, an Expo bundle, a mobile app, a
  public repository, a URL, or client-visible logs.
</Warning>

For storefront implementation, continue with the [Storefront SDK guide](/getting-started/storefront-sdk) or [REST API essentials](/getting-started/rest-api).