API Keys

API Keys are used to authenticate your application and control its access to the Chargebee API.

It is strongly advised to keep API keys secret, especially those that give full access to the API.

To create and configure the API keys, select Settings > Configure Chargebee > API Keys and Webhooks and then click on the API Keys tab. Any existing API keys are listed.

Types of API keys

There are three major types of API keys:

• Full-access key
• Publishable key
• Read-only key

Full-access key

A full-access key is used to access all API resources in your Chargebee site. All the resources listed in the [link_api]API reference[] can be accessed using this type of key.

The full-access key has three subtypes, each providing different levels of write permissions. The following table summarizes the type of API operations that can be carried out by each subtype:

Publishable key

This key can only be used to create new subscriptions. You can extend the permissions of this key to more API operations as will be shown next.

The possible API call for a regular Publishable Key is:

• Process purchase command

You can add the following access levels to a publishable key:

1. Allow Estimate API Calls This gives a publishable key access to Estimates API.

2. Allow read-only access to Product Catalog This gives a publishable key read-only access to the Item Families, Items, and Item Prices API.

   Note: To prevent misuse, coupons, coupon sets and coupon codes API are not accessible with this key.

Read-only key

This type of key has a few sub-types, offering varying levels of read-only access to the Chargebee API.

1. Read-only: All This type of key allows you to perform any read-only API call in Chargebee.
2. Read-only: Restricted Depending on the checkboxes selected, this type of key allows read-only access to one or both of the following sets of API groups:
   1. Allow read-only access to transactional data: Read-only access to the following set of API groups is allowed: Subscriptions, Customers, Payment Sources, Virtual Bank Accounts, Cards, Invoices, Credit Notes, Unbilled Charges, Orders, Gifts, Transactions, Quotes, Addresses and Events
   • Allow read-only access to your Product Catalog Read-only access to the Item Families, Items, and Item Prices API is allowed.

     Note: To prevent misuse, coupons, coupon sets and coupon codes are not accessible with this key.

Creating an API key

To create a new API key, click on the Add an API Key button, choose the type of key to create, give it a name and click Create Key.

Using an API key

You must pass the API key as input for any API request. Consider the following example showing a cURL request made to the Create a customer endpoint.

curl  https://\{site}.chargebee.com/api/v2/customers 
    -u {site_api_key}:
    -d first_name="John" 
    -d last_name="Doe" 
    -d email="john@test.com" 

In this example, you need to replace {site_api_key} with your API key.

To see examples using the SDK in the programming language of your choice, check out any endpoint in the API reference.

Disabling/deleting keys

A key can be disabled or deleted using the more options button on the card for the key.

• Disabling a key prevents any applications using it from making API calls to Chargebee. Disabling allows you to re-enable the key later.
• Deleting a key purges it forever. The same key is never created again.

Note: At least one full access key must be present for a site; you cannot delete all of them.

Like passwords, it is recommended that you periodically replace old keys with new ones. This improves security. While at it, it is always best to first create the new API keys, update all the existing keys on your application with the new keys, and only then delete the old keys from Chargebee.

Discontinued key types

Some key type combinations have been discontinued since and can no longer be created. However, this change is non-breaking. So if such keys were already created by you and are being used, they will continue to work with all their permissions.

Listed below are some examples of key type combinations that have been discontinued:

• Extended Publishable Key without Use from Browser
• Extended Publishable Key + Publishable Key without Use from Browser
• Extended Publishable Key + Read Product Configuration without Use from Browser
• Extended Publishable Key + Read Transactional Data without Use from Browser
• Read Product Configuration with Use from Browser
• Read-only Access + Extended Publishable Key
• Read-only Access + Publishable Key
• Read Transactional Data + Extended Publishable Key + Read Product Configuration without Use from Browser