Customer · Settings

Creating an API key

Create an API key to connect your own software (ordering, ERP, warehouse system) to Courino, pass it to your developer and revoke it.

An API key is a secret password that lets your own software get prices and create orders on your behalf. You create the key and pass it to your software developer; the developer adds it to every request.

If you don't see this card, your account doesn't have the API and webhooks permission. Ask your courier company for it.

Creating a key

Click My details in the left menu.
Find the Integration (API keys) card further down.
Type where the key will be used in the box (e.g. "ERP" or "Website"). This name helps you later tell which key belongs to what.
Click Create key.
The key starting with kosk_ appears in a green box. Click Copy to take it.
Pass the key to your developer securely (e.g. a password manager). Don't write it in plain text in an email or a message.

The key is shown only once. You can't see it again after you close the page; if you lose it, create a new key.

What your developer needs to know

The key is sent with every request in the Authorization: Bearer kosk_… header.
The key works with the permissions of the account that created it: if that account can't place orders, neither can the key.
The key can't touch the password, cards or account settings, start a payment or open a support ticket. It can only read your payments and statement.
The API docs button at the top right of the card opens the docs, which describe every endpoint and let you try them in the browser. See Integration API for details.

Managing keys

The list at the bottom of the card shows each key's name, its last 8 characters (e.g. kosk_…Xk3p9QaZ), creation time and last used time. To tell which key is which, compare them with the last characters of the key you have.

Create a separate key for each system. That way, closing one leaves the others working.
You can have at most 5 active keys at a time. Revoke one you don't use to make room.
Click Revoke next to a key you don't use or think someone else may have. The key stops working within 30 seconds. Revoking can't be undone.

When the password changes

When your account's password changes, all of that account's keys are revoked: when you change it, when your courier company resets it, or when you renew it with Forgot password. This makes sure the keys of an account whose password was stolen are closed too. After a password change, create a new key and pass it to your developer.

Having trouble?

The integration card doesn't appear: Your account hasn't been given the API and webhooks permission. Ask your courier company.
I forgot to copy the key: The key isn't shown again. Revoke the old one and create a new key.
The integration suddenly stopped working: Your password may have changed or the key may have been revoked. If the list shows revoked next to the key, create a new key.
The Create key button doesn't work: Type a name in the box first. If you have 5 active keys, revoke one.
The developer gets a "429" error: One key can send at most 120 requests per minute. Your developer should slow down the requests or wait as long as the response says.