API Keys — Programmatic Access to Shopbell

API Keys in the Developer Portal (/api-keys page) let your backend trigger Shopbell workflows, fetch recordings, manage telephony, and integrate with your systems programmatically. Keys are per-organization (your company). Login creates a default key — you can create more, archive old ones, and rotate the default any time.

What the dgr_ prefix means

API keys for programmatic access to Shopbell endpoints (triggering agents, fetching runs, managing telephony configurations) start with dgr_. These keys authenticate HTTP requests to https://app.shopbell.ai/api/v1/* as a Bearer token. Handle them like passwords. Anyone with a dgr_ key can access your entire Shopbell organization — trigger outbound calls, read every recording, change telephony, delete workflows.

What the oss_sk_ prefix means

Service keys (for LLM, TTS, STT inference) start with oss_sk_. These keys authenticate to Shopbell's managed inference layer — the Model Proxy Service that hosts our LLM, text-to-speech, and speech-to-text engines. Service keys are used by your workflows when you select 'Shopbell-managed' for any model configuration.

If you upgrade to a higher usage tier, you can generate additional service keys for different model configurations (e.g., one key for production agents with the best model, one for test agents with a cheaper model). To generate a new service key, click the 'New Service Key' button in Developer Portal.

Creating and rotating keys

Click New Key. Name it (e.g., 'Production Backend', 'Zapier Integration', 'Personal Testing'). The key appears once with a copy button — copy it immediately. Once you leave the page, the full key is no longer visible (only the first 8 characters, like dgr_zmid...).

To rotate (replace) a key, archive the old one and create a new one. Update your integrating systems with the new key. The old key stops working immediately. For zero-downtime rotation: create the new key first, update all your integrations, then archive the old one.

Securing your keys

Never commit keys to git. Put them in environment variables, secrets manager, or .env files that are gitignored. Never embed dgr_ keys in client-side JavaScript, mobile apps, or anywhere a customer can read them. Always route keys through your backend. Rotate keys quarterly or any time someone with access leaves your team.

Frequently Asked Questions