API keys
Manage the keys that let external systems (including ERP integrations) talk to your company's Bione account.
Why API keys exist
An API key is how an external system (your ERP, a custom integration, a third-party tool) authenticates with Bione on behalf of your company. Without a key, external systems can't read your catalog, update orders, or sync stock.
How to navigate the API keys screen
- List — each key with a label, status, and created date.
- Add key — give it a name (label) so you know which system uses it.
How to create an API key
- Open the API keys screen.
- Tap Add key.
- Enter a label (for example "Bito ERP sync" or "Custom inventory tool").
- Confirm — the key is shown once. Copy it immediately — it cannot be shown again.
When to create a key
- Connecting an ERP — the integration flow creates one automatically, but you can also create one manually for advanced setups.
- Building a custom integration — create a key with the specific scopes your integration needs.
Why keys are shown only once
Bione stores only a hash of the key — the original string is never saved. If you lose it, you must revoke and create a new one. This is a security measure: even Bione's database can't be used to extract your keys.
How keys are used
An API key authenticates your company when calling the Bione API. Keep a key secret — it lets the holder act on behalf of your company (read the catalog, and — depending on permissions — place or update orders, and sync products).
You may have more than one key, for example one per integration.
When to revoke a key
- Employee leaves — if they had access to a key, revoke and create a new one.
- Key compromised — if a key was accidentally committed to a repository or shared publicly, revoke immediately.
- Integration no longer used — revoke keys for integrations you've disconnected.
How to revoke a key
From the API keys list, select the key and tap Revoke. The key stops working immediately. Any system using it will get 401 errors.
How scopes work
Each key has a set of scopes — permissions that define what the key can do. Common scopes include read/write access to products, orders, and customers.
When to limit scopes
Always. Give a key only the scopes it needs. A key that only reads products doesn't need order-write access. This follows the principle of least privilege — if the key is compromised, the damage is limited.
Next steps
- Integrations — connect a system using a key
- API overview — what the key unlocks