API Keys are essential when you have to authenticate your session while trying to connect to Chargebee's API.
You can find your API keys in the web interface under Settings > API and Webhooks > API Keys
While adding an API Key, you have the option to select a permission level for the Key. There are five permission levels that are available in Chargebee. They are:
1. Full Access
This access provides complete access to your Chargebee site. Only set this access level when you're using it along with your own application server and you need more functionality than to just create subscriptions. Ensure you take proper care of your API keys as it provides complete administrative control through the API.
2. Read Transactional Data
Enable this access only when you need your system to fetch data from Chargebee.
E.g. It can be used when integrating using 3rd party apps like Zapier to synchronize data.
This level of permission can ONLY be used to read transactional data from subscriptions, customers, cards, invoices, orders, transactions,addresses, events,
3. Extended Publishable Key
This access includes the same permissions as the publishable key, but also allows to use the "Estimate API" call as well. This API call is useful when estimating charges when creating or updating subscriptions, especially when addons, coupons or VAT is included.
4. Publishable Key
This access is recommended for operations that involve the use of forms for creating subscriptions.
This access level allows Create a subscription, Checkout new subscription, and API calls.
5. Read Product Configuration
This access allows you to fetch product configurations of plans and addons.
E.g. It can be used with a shopping cart or 3rd party app synchronization service to pull plan & addon details from Chargebee.
Coupon and coupon codes are not accessible with this access level.
You can generate new API keys whenever necessary and use that for authenticating your API calls to Chargebee. Unused API keys can be disabled as well.
While recycling your API keys, it is always best to create a new API key, update all the existing keys on your site with the new key, and then delete the old keys from Chargebee.
The API keys for the live site as well as the test site are always different.
Please make sure you're using the live site's API key when making changes to customer subscriptions on the live site instead of using the test site's API key.
API Keys are as important as passwords.
