Best practices for API keys and access
An API key gives access to your Provei account and can spend your credits. Keep keys on the server only, never in the site code, and replace a key right away if it leaks.
Where a key can live
Section titled “Where a key can live”Use the key only in systems that run on your store’s server, such as an ERP or a custom integration.
Never put the key:
- in the theme, the HTML or store scripts that run in the browser;
- in apps installed on your customers’ phones;
- in code repositories, shared spreadsheets, emails or messages.
The try-on install code carries no API key. If someone asks for the key to install the try-on in your theme, be suspicious.
In the dashboard, keys are shown masked, like pv_xxxxxxxx••••. The full key appears only once, when you create it.
Create a key
Section titled “Create a key”- Open Conta › Desenvolvedor (Account › Developer) and tap Criar chave (Create key).
- In Nome (opcional) (Name (optional)), write where the key will be used, for example Servidor da loja (Store server). This helps you know where each key is in use.
- Copy the key on the Copie sua chave agora (Copy your key now) screen. For security, it won’t be shown again.
- Store the key somewhere safe, such as your team’s password manager.
Create one key per system. That way, if a system is compromised, you revoke only its key. See more in API keys.
Replace or revoke a key
Section titled “Replace or revoke a key”Replace the key if it leaked, if someone who had access to it left the team, or if you don’t know where it’s in use.
- Create a new key and set it up in your systems.
- On the old key, tap Revogar (Revoke) and confirm with Revogar chave (Revoke key).
If the key leaked, don’t wait: create the new one, revoke the old one, and then update your systems.
Give your team access
Section titled “Give your team access”Don’t share your login. Each team member should have their own access.
- Open Conta › Equipe (Account › Team) and tap Convidar pessoa (Invite person).
- Enter Nome completo (Full name) and E-mail (Email) and tap Enviar convite (Send invitation). The person gets an email to create their password.
People you invite can access everything except Equipe and Plano e créditos (Plan and credits). That includes Conta › Desenvolvedor, so team members can also create and revoke keys.
When someone leaves the team, tap Remover (Remove) next to their name. The person loses access to the dashboard immediately. Also review the keys they knew and replace the ones that need it.
If someone forgets their password, use Redefinir senha (Reset password). The dashboard shows a temporary password only once: send it to the person through a secure channel.
Suspicious requests
Section titled “Suspicious requests”Provei never asks for your password, temporary password, API key or token by email, WhatsApp or phone. Only use the channels on this page: suporte@provei.ai and WhatsApp +55 11 5296-0168. Requests to enable a store address, turn on features or change plans must come from the account owner.
Frequently asked questions
Do I need to put the API key in my store theme for the try-on to work?
No. The try-on install code carries no API key. The key is only for your store's systems that call the Provei API from a server.
What do I do if a key leaks?
Create a new key, swap it into your systems, and revoke the leaked key in Conta › Desenvolvedor (Account › Developer). Systems that use the revoked key stop working immediately.
Can I share my dashboard login with my team?
We don't recommend it. Invite each person in Conta › Equipe (Account › Team). Each one signs in with their own email and password, and you can remove their access whenever you need to.