Skip to main content

​
Bearer keys

Every request must send an Authorization: Bearer <key> header. The key format is sk_live_ followed by 32 hex characters (40 characters total). Sandbox keys use the sk_test_ prefix; production keys use sk_live_.
Keys are hashed with scrypt and stored salted. The raw value is shown exactly once, when the key is created. LandedFees cannot recover a lost key.

​
Where to mint keys

  1. Sign in and open Settings > API keys.
  2. Click Create key, give it a memorable name (e.g. prod-erp, ci-nightly-audit), and copy the raw value.
  3. Store the key in your secret manager (AWS Secrets Manager, Vault, Doppler, GitHub Actions secrets, etc.). Never commit it.

​
Key rotation

Rotate keys on the same cadence as your other production secrets. A 90-day cycle is a reasonable default.
  1. Mint a new key.
  2. Deploy the new key to your systems.
  3. Watch Settings > API keys > last used on the old key until it stops firing.
  4. Revoke the old key.
Rotation is zero-downtime: multiple active keys can coexist under one organization.

​
Revocation

Revoked keys return 401 API_KEY_REVOKED immediately on the next request. Revocation is instant and irreversible. Revoke a key when:
  • It leaks into a repo, log, or client-side bundle.
  • An engineer who owned the key leaves the team.
  • A dependent system is decommissioned.

​
Per-tier quotas and gating

API access requires a Growth-or-higher subscription. Free and Pro tiers cannot mint keys, and any existing key on a downgraded organization returns 402 TIER_DOWNGRADED on the next call. Upgrading restores access without needing to rotate. Monthly quotas roll over at 00:00 UTC on the first of the month. When you exceed the quota, subsequent calls return 402 QUOTA_EXCEEDED until the reset or an upgrade.

​
Sandbox mode

Mint an sk_test_... key from Settings > API keys > Test keys. Sandbox calls do not count against your monthly quota. Rate tables in sandbox match production exactly (there is no fake data), so responses are trustworthy for integration testing.

​
Security posture

  • TLS 1.2 or higher only. Requests to http:// are refused.
  • Rate limit: 60 requests per minute per key. See Rate limits.
  • Every response carries an X-Request-Id header. Include it in support requests so we can pull the call log.
  • Keys never appear in server logs, error envelopes, or webhook payloads.