Before issuing a key
- Sign in with the corporation master account.
- The corporation must have the Pro Integration entitlement.
- Validation uses the issuing user; customer keys have no selectable or additional scopes.
Issue the key in ORCA
- Sign in to ORCA and open Integration Management → Open API Keys.
- Select Create key and enter a recognizable name and optional expiry.
- Copy the plaintext key immediately; ORCA displays it only once.
- Store it as ORCA_API_KEY in the own-mall backend secret manager.
ORCA OPEN API key management →
Storage rules
- Never store it in a browser, mobile app, public repository, or order database.
- Never log the Authorization header or plaintext key.
- If ownership changes or exposure is suspected, issue a replacement and revoke the old key.
List and revoke
The list shows metadata and a prefix, never the plaintext key. Revocation takes effect immediately. If issuance fails, ORCA operators can inspect the corporation entitlement and key status in Master Admin.