Generating and Managing API Keys
How to create, rotate, and revoke API keys from Settings > Developer, plus best practices for keeping them secure.
API keys authenticate your integrations against the USystems REST API, so treat them with the same care as a password. All key management happens under Settings > Developer.
- Open Settings > Developer and select New API Key.
- Give the key a descriptive name, such as "billing-sync-production," so you can identify its purpose later.
- Choose the scopes the key needs — read-only access is enough for most reporting integrations, while write access should be limited to the specific modules that require it.
- Copy the key immediately; for security reasons, the full value is only shown once.
- Store the key in a secrets manager or environment variable, never in source code or a shared document.
Rotate keys periodically, especially after a team member with access leaves the organization or if you suspect a key may have been exposed. Rotating creates a new key while the old one keeps working for a short overlap window, so you can update your integration without downtime. To revoke a key immediately, select Revoke next to it in the key list — this takes effect within seconds and cannot be undone.
Was this helpful?