Skip to main content
Secret keys grant full programmatic access to your organization’s data. They must be kept server-side and never exposed in client code.

​
Format

​
Usage

Pass the key as a Bearer token in the Authorization header:

​
Capabilities

Secret keys can do everything — read and write:
  • Create checkout sessions
  • Create and cancel subscriptions
  • Read subscription status for any tenant
  • Manage seat allocations
  • Record usage events

​
Security

Never put a secret key in client-side code, environment variables prefixed with NEXT_PUBLIC_, or any file that gets bundled to the browser.
Store it in a server-side environment variable:

​
Generating Keys

From the Crovver dashboard: Settings → API Keys → Generate Secret Key. Keys are only shown once at creation — store them securely immediately. If lost, generate a new one and rotate the old one.