API Keys

API keys enable programmatic access to Levy Fleets data and functionality. Create keys for custom integrations, data exports, and third-party applications.

Overview

What API Keys Do

API keys allow:

• Programmatic data access
• Third-party integrations
• Custom reporting tools
• Automated workflows
• Mobile app development

Authentication Flow

1. Request includes API key header
2. Key is validated
3. Permissions are checked
4. Request is processed
5. Response is returned

Creating API Keys

Step-by-Step

1. Navigate to Settings > API Keys
2. Click Create API Key
3. Configure the key:
   • Name (for identification)
   • Permissions
   • Expiration (optional)
4. Click Create
5. Copy the key immediately

Key Configuration

Naming Best Practices

Use descriptive names:

• Production-Analytics-Integration
• Staging-Mobile-App
• Partner-XYZ-Access
• Internal-Reporting-Tool

Permissions

Permission Levels

Resource Permissions

Configure access per resource:

Example Permission Sets

Analytics Integration:

• Rides: Read
• Vehicles: Read
• Customers: Read
• Analytics: Read

Mobile App:

• Rides: Read, Create, Update
• Vehicles: Read
• Customers: Read, Update

Admin Tool:

• All resources: Full access

Using API Keys

HTTP Header

Include key in Authorization header:

Authorization: Bearer YOUR_API_KEY

Example Request

curl -X GET "https://api.levyfleets.com/v1/rides" \
  -H "Authorization: Bearer sk_live_abc123..." \
  -H "Content-Type: application/json"

Base URL

Production: https://api.levyfleets.com/v1 Sandbox: https://api-sandbox.levyfleets.com/v1

Key Types

Live Keys

For production use:

• Prefix: sk_live_
• Access production data
• Affects real operations
• Use in production systems

Test Keys

For development/testing:

• Prefix: sk_test_
• Access sandbox environment
• Safe for testing
• No real data affected

Managing Keys

Viewing Keys

The API Keys page shows:

• Key name
• Partial key (last 8 chars)
• Permissions summary
• Last used date
• Status

Editing Keys

Modify existing keys:

1. Click on the key
2. Update name or permissions
3. Save changes

Revoking Keys

To deactivate a key:

1. Click on the key
2. Click Revoke
3. Confirm revocation

Revoked keys:

• Immediately stop working
• Cannot be reactivated
• Remain in list for audit

Deleting Keys

To permanently remove:

1. Click on the key
2. Click Delete
3. Confirm deletion

Deleted keys:

• Removed from list
• Cannot be recovered
• Audit log retained

Rate Limiting

Default Limits

Rate Limit Headers

Response includes:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 55
X-RateLimit-Reset: 1640000000

Handling Rate Limits

When limit exceeded:

• HTTP 429 response
• Retry-After header
• Implement exponential backoff

Security Best Practices

Key Storage

• Never commit keys to version control
• Use environment variables
• Store in secrets manager
• Rotate keys regularly

Key Rotation

Rotate keys periodically:

1. Create new key
2. Update your systems
3. Test with new key
4. Revoke old key

Monitoring

Track key usage:

• Monitor request volume
• Watch for unusual patterns
• Set up alerts
• Review access logs

Principle of Least Privilege

• Grant minimum needed permissions
• Use separate keys per integration
• Don't share keys between environments
• Revoke unused keys

API Key Scopes

Subaccount Scopes

Limit keys to specific subaccounts:

• All subaccounts
• Specific subaccounts only
• Single subaccount

IP Restrictions

Restrict key usage by IP:

1. Click on the key
2. Add allowed IPs
3. Save changes

Only requests from listed IPs will work.

Troubleshooting

Authentication Failed

401 Unauthorized response:

1. Verify key is correct
2. Check key isn't revoked
3. Confirm Authorization header format
4. Check key hasn't expired

Permission Denied

403 Forbidden response:

1. Review key permissions
2. Check resource access
3. Verify subaccount scope
4. Confirm IP allowlist

Rate Limited

429 Too Many Requests:

1. Check rate limit headers
2. Implement backoff
3. Request limit increase
4. Optimize request patterns

Key Not Working

If key stops working:

1. Check key status in dashboard
2. Verify key hasn't been revoked
3. Check for expiration
4. Test with fresh key

API Documentation

Accessing Docs

Full API documentation available at:

• https://docs.levyfleets.com/api
• Swagger/OpenAPI spec
• Interactive API explorer

Available Endpoints

SDKs

Official SDKs available:

• JavaScript/TypeScript
• Python
• Ruby
• PHP

---