Managing Keys

AbeBooks supports multiple API keys per seller, each with specific service permissions. This lets you use separate credentials for different services, rotate keys without downtime, and keep tighter control over access.

Key Management Portal

All credentials are managed from the API Key Management page when logged into your seller account. From here you can:

  • Generate new keys
  • View all active, disabled, and revoked keys
  • See when each key was last used
  • Authorize keys for specific services
  • Label keys for easy identification
  • Disable or revoke keys

Purchase API credentials are managed separately via Manage Purchase API Keys. See the Purchase API Authentication page for details.

Key Types

Type Used For Details
Signed (access key / secret key pair) API request signing Used with Signing Requests for Order Update API and Inventory Update API
Classic (hashed key) API and FTP password auth Traditional username + password style credentials
SSH (public key) FTP authentication Used with SSH Key Authentication for Inventory FTP and AMoP FTP

Service Authorization

Each key can be authorized for one or more services:

  • Inventory Update API
  • Order Update API
  • Inventory FTP
  • AMoP FTP

When generating or editing a key, select which services the key should have access to. A key will be rejected if used against a service it is not authorized for.

Generating a New Key

  1. Navigate to API Key Management
  2. Click Generate New Key
  3. Select the key type (Signed, Classic, or SSH)
  4. Select the service(s) to authorize
  5. Optionally add a label (e.g., "Warehouse Server", "Third-Party Integrator")
  6. Click Generate

For Signed keys (access key / secret key pair) and Classic keys (hashed key), the secret value is shown once at generation time. Store it securely — it cannot be retrieved later.

Key Rotation

Because you can have multiple active keys per service, rotation is straightforward:

  1. Generate a new key authorized for the same service(s)
  2. Update your integration to use the new key
  3. Verify the new key works
  4. Disable or revoke the old key

This approach means zero downtime during rotation, as both keys are valid simultaneously until you remove the old one.

Disabling and Revoking Keys

  • Disable: Temporarily prevents a key from authenticating, but can be re-enabled later.
  • Revoke: Permanently invalidates a key. This cannot be undone.

Both actions take effect immediately.

Limits

  • Maximum of 10 active keys per seller across all types and services
  • Signed keys are authorized for a single service each
  • SSH keys can be authorized for multiple FTP services