API Key Management
How to generate, manage, and use API keys for programmatic access to ExCoil calculations from your ERP or custom systems.
1. Overview
API keys allow Enterprise plan users to access ExCoil's calculation engine programmatically via REST API. This enables integration with ERP systems, custom selection software, automated quoting tools, and batch calculation workflows. Each API key is a unique credential that authenticates requests to the /api/v1/ endpoints.
Enterprise Only: API key generation requires an active Enterprise subscription. Professional and Free plans do not have API access.
2. Generating a Key
- Navigate to the API Keys page in the dashboard sidebar
- Click 'Generate New Key'
- Enter a descriptive name (e.g., 'ERP Integration', 'Quoting Tool')
- Select permissions (calc:read for calculations, projects:read for project access)
- Copy the generated key immediately — it will not be shown again
API keys follow the format: exk_[64 hex characters]. The prefix 'exk_' identifies it as an ExCoil API key. Only the first 12 characters (prefix) are stored for display; the full key is hashed for security.
3. Permissions
| Permission | Scope | Description |
|---|---|---|
| calc:read | Calculations | Execute all calculator endpoints |
| projects:read | Projects | Read project data and versions |
| * | All | Full access to all API endpoints |
4. Rate Limits
Each API key has a rate limit of 100 requests per minute by default. Rate limit information is included in response headers:
X-RateLimit-Limit: Maximum requests per minuteX-RateLimit-Remaining: Requests remaining in current windowX-RateLimit-Reset: Unix timestamp when the window resets
5. Security Best Practices
- Never expose API keys in client-side code or public repositories
- Use environment variables to store keys in your application
- Create separate keys for different applications or environments
- Revoke keys immediately if compromised
- Use the minimum required permissions for each key
- Maximum of 10 active keys per account
6. Managing Keys
From the API Keys page, you can:
- View: See key prefix, name, creation date, last used date, and request count
- Revoke: Deactivate a key (stops accepting requests but keeps the record)
- Delete: Permanently remove a key and its usage history