Open **Settings → API keys**. Only the **Owner** sees this tab.

## Two kinds of keys

- **PIM API (incoming)** — the key *your* system (ERP, store, script) uses to connect to the PIM API.
- **External service key (outgoing)** — the key PIM uses to connect to another service: Nomasveikals, OpenCart, CS-Cart, DeepL, Tilde, Claude, OpenAI, etc.

## Creating a key

1. Click **Add key**.
2. Choose the **Service**.
3. Enter the **key** (at least 8 characters). For a PIM API key use a long random string — for example 40 characters from a password manager.
4. For a PIM API key choose the **permissions**:
   - **Read catalogue**;
   - **Write products and assortment**;
   - **Write supplier offers**.
5. Save.

> **Store the key somewhere safe straight away.** PIM keeps it encrypted, and after saving only the **last 4 characters** are shown — nobody can see the full key again.

A request with a key that lacks the needed permission gets a **403** error (`key_scope`).

## Managing keys

- **Deactivate** — pause it without deleting;
- **Activate** — turn it back on;
- **Delete** — permanently.

Keys marked **Managed by the operator** were set up by EcomCart — you can't change them.

If a key has fallen into the wrong hands, **delete** it immediately and create a new one.

How to use the key: [API for developers](/hc/pim/articles/en-api-overview).