Creating and Managing VenuePilot API Keys

What is an API Key?

An API key securely connects a third-party tool to a single VenuePilot account without sharing logins. Creating an API key is very similar to creating a user role—you select the exact same permission parameters, essentially assigning a role to an external tool.

Managed under Settings → API keys, a key only carries permissions held by its creator. If the creator’s role changes or their account is removed, the key’s access automatically shrinks or stops entirely. Keys expire within one year, and full secrets are shown only once upon creation. Existing setups can be Rotated (replace a secret), Duplicated (copy role parameters for another tool), or Revoked (permanently cut access).

An API key acts as a secure access code for outside software applications. When you generate an API key, it allows an external tool to read or update data within one specific VenuePilot account on your behalf.

Important Security Rules:

• One Key, One Account: API keys are tied to a single VenuePilot account. If your business spans multiple locations or accounts, you will need to generate a separate key for each one.
• No Extra Access: An API key can never do more than what your own user profile is allowed to do in VenuePilot.
• Live Permission Sync: If your user account role is ever updated or downgraded, any API keys you created will automatically update to match your new permission level. If your account is removed from the venue, any keys you created will immediately stop working.

Accessing API Key Settings

To view, create, or manage API keys for your venue:

1. Log into your VenuePilot Admin Portal.
2. Navigate to Settings $\rightarrow$ API keys.

How to Create a New API Key1.Navigate to API Keys:Ensure you are logged into the correct account.Go to Settings $\rightarrow$ API keys in your VenuePilot dashboard.

2.Select Permissions:Keys cannot exceed your current user role.Click Create Key. Give your key a clear name (e.g., the name of the integration) and select the specific permission groups the integration requires.

3.Choose an Expiration Period:Maximum lifespan is 1 year.Select an expiration timeframe for the key (up to a maximum of 1 year). You will receive automated email reminders 30 days, 7 days, and 1 day before the key expires so you can generate a replacement without interrupting your service.

4.Copy and Save Your Secret Key:CRITICAL STEP: Keys are shown only once. Copy the
generated secret key immediately and store it in a secure location. For security reasons, this key will never be shown again and cannot be recovered after you close the window.

Key Management:

Rotate, Duplicate, or Revoke. You can manage your existing active keys directly from the Settings → API keys screen. Only the user who created the key can perform these actions.

 

Action	What it does	When to use it
Rotate	Replaces the secret key immediately while preserving the existing permissions, account settings, and expiration date.	Use when an existing key secret has been compromised or leaked, but you want to maintain the integration setup.
Duplicate	Copies the exact permission setup of an existing key to quickly generate a new, secondary key.	Use when setting up a second integration that requires identical permissions.
Revoke	Instantly and permanently disables the API key. This action cannot be undone.	Use when you stop using a third-party service or need to permanently shut off access.

 

Common Issues & Error Troubleshooting

"You do not belong to the requested account"

• Why this happens: You must be an added member of the specific venue account to create a key for it.
• How to fix: Ensure you are logged into the correct venue account or request an account administrator to invite your email to the team.

"Requested permission exceeds your own grant"

• Why this happens: You attempted to grant an API key a permission that your own user role does not currently possess.
• How to fix: Contact an Account Admin to upgrade your user role permissions, or uncheck the extra permission boxes when creating the key.

An integration suddenly stops working

If an integration stops responding and the key was not manually deleted, check the following:

1. Has the key expired? Check the key's expiration date under Settings → API keys.
2. Has the key creator's role changed? If the user who created the key was removed from the team or had their permissions restricted, the key's access will automatically shrink or deactivate.
3. Need a permission change? API key permissions cannot be edited after creation. If your integration requires new permissions, you must create a new key with the updated selections and revoke the old one.