market
Getting and looking after a key
| Getting one | Email [email protected]. Tell us what the integration does and roughly how often it will call — that is what we size your rate limit against. |
| Delivery | The key is generated once and shown once. We cannot recover it, because we store only a hash of it — if it is lost, we issue a new one and revoke the old. |
| Storage | Treat it as a password: a secret store or an environment variable, never in source control, never in a client-side application. It carries no expiry information you can read, so keep a note of the date we gave you. |
| Several keys | You can hold more than one — one per environment, or one per job, so that rotating or revoking one does not stop everything. Ask for them by purpose (prod cron, staging) and we will label them that way. |
| Rotation | Ask for a new key, deploy it, confirm traffic has moved, then tell us to revoke the old one. Do it in that order: revocation takes effect on the very next request, with no grace period. |
| If it stops working | Read the code, not the message. 40101 means expired — ask us to reissue, nothing is wrong on your side. 40102 means revoked — talk to us before retrying, because someone stopped it deliberately. 40100 means we do not recognise it at all: check for a truncated or wrapped value first. |
| If you think it leaked | Tell us immediately and we revoke it. Include the first characters of the key (the cwc_live_… prefix) so we can identify which one — never send us the whole key by email or chat. |