API keys

API keys authenticate requests to the Paddle API from your backend. You create them in the Paddle dashboard, assign permissions to limit what they can do, and set an expiry date so they don't live forever.

API key entities hold information like:

• The name and description of the key, so you can tell where it's used.
• Its status: active, expired, or revoked.
• The permissions assigned to the key.
• When the key expires, when it was last used, and whether it has been exposed.
• Whether the key is rotatable.
• An obfuscated version of the key, like pdl_live_apikey_01jkdpbhaz****. The full key is only shown once, when you create it.

Listing API keys, and getting any key other than your own, requires the api_key.read permission. Legacy API keys, created before May 6, 2025, don't have permissions. They're returned with permissions: null, and their obfuscated key doesn't have the pdl_ prefix.

Rotatable keys can also be rotated using the API. A rotation replaces the secret of a key while the key keeps its ID, name, and permissions. Paddle returns the new secret once, when you create the rotation, and the old secret keeps working for a grace period that you set when you create the rotation. The grace period starts when the new secret is first used. Rotation operations don't require a permission, but a key can only rotate itself. See Rotate with the Paddle API.