> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eat-now.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and revoke an API key

> Give an external tool access to the restaurant with the required permissions.

Open **Settings → Integrations → API keys**. The restaurant needs the **API**
feature and you need integration access.

A key belongs to **one restaurant**. It lets an external tool read or manage
data with selected permissions, without sharing your staff account.

## Create a key

1. Click **Create API key** and give it an identifiable name, such as “Hotel
   connector”.
2. Review selected **scopes**. The form starts with broad selections; keep only
   those required by the connector.
3. Choose an expiration if needed.
4. Create the key and immediately copy the full token into the connector’s
   secure storage.

The list later shows only a **prefix**, not the full secret. A prefix followed
by dots cannot authenticate a request.

## Understand scopes

Groups cover catalog, availability, reservation reading, sensitive data,
creation/modification, cancellation, forced confirmation/insertion, webhooks and
missed calls.

For example, a tool only checking availability does not need to force bookings.
Key scopes and staff roles are separate settings.

The developer uses the token in the `Authorization: Bearer …` header. See the
[API reference](/api-reference/introduction) for routes and formats; do not put
the key in a public script or support request.

The form lists `WEBHOOKS_WRITE`, but no public v1 route manages webhooks.
Configure them in EatNow settings. See
[scope details](/api-reference/authentication) for permissions and masked
fields.

## Revoke and troubleshoot

The list shows scopes and last usage. Open a key’s menu and select **Revoke** to
remove access; the connector using it will stop working.

A lost key cannot be read again: create a replacement and revoke the old one
following your procedure. For access errors, check the full token, restaurant,
expiration, revocation and scopes. Give support the name/prefix and error
message, never the secret.