Generate and rotate API keys

For: An admin who needs to hand a key to an engineer, or rotate one after a departure or a scare.

You’ll accomplish: creating the right kind of key, storing it safely the one time it’s shown, and rotating or revoking it cleanly when you need to.

An API key is how your team’s own software signs in to PropSocket’s API to read your data — the programmatic equivalent of a login. You don’t need to write code to manage keys; you just need to understand a few rules so you don’t lock anyone out or leave a key lying around.

---

1. Live keys vs. test keys

Every key is one of two modes, and you can tell which from its prefix. Both authenticate against the same PropSocket API and read your real, connected data — the only difference is what happens when your software makes a write:

• ps_live_… — a live key. Reads and writes both take effect: a write commits and is delivered downstream to your PMS. Treat it like a password to your portfolio.
• ps_test_… — a test key (Isolated Test Mode). Reads return the same real data a live key would. Writes are validated exactly like production — same checks, same error shapes — then return a mocked success and are never processed or delivered to your PMS. It’s a safe dry-run, which makes it the right key to hand an engineer building or testing a write integration. (See Isolated Test Mode for the full developer reference.)

Always check the prefix before handing a key off. A common mistake is giving an engineer a ps_live_ key for testing when a ps_test_ key — which can’t change anything downstream — was all they needed.

2. The “shown once” rule — read this before you click create

When you create a key, PropSocket shows you the full key exactly once, right after creation. After that, it only ever displays the prefix (like ps_live_) so you can tell keys apart. PropSocket cannot show you the full key again — it doesn’t store it in a readable form.

This is a security feature, not a limitation. It means a leaked database can’t hand out your keys. But it also means:

• Copy the key the moment it appears and put it somewhere safe — a password manager or your team’s secrets vault, not an email or a chat message.
• If you lose it, you don’t recover it — you rotate it (next section). There’s no “show me the key again” button, by design.

3. Create a key

1. Open API Keys in your dashboard and click New Key.
2. Choose live or test based on what it’s for.
3. Give it a clear, human name — something like “Analytics pipeline (prod)” or “Jordan’s local testing.” A good name is what makes rotation painless later.
4. Optionally set an expiration — never, 30 / 90 / 180 days, or 1 year. A dated key is one fewer thing to remember to rotate.
5. Create it, then copy the full key immediately and store it safely. This is the one time you’ll see it.

4. Rotate a key

Rotating means creating a fresh key and retiring the old one. You rotate on a schedule for hygiene, or right away if something’s wrong.

1. Create a new key (step 3) with a name that signals it’s the replacement.
2. Hand the new key to whoever uses it — your engineer, or the system it’s configured in — and have them swap it in.
3. Confirm the new key is working before you touch the old one. Watch for the integration or service to keep running normally.
4. Revoke the old key once nothing depends on it (next section).

Doing it in this order — new key live first, old key revoked second — means nothing goes dark during the swap.

5. When to revoke a key

Revoking turns a key off permanently. Anything still using it will immediately stop being able to read your data, so revoke deliberately. Do it when:

• Someone leaves. When an engineer or contractor offboards, revoke any keys they created or had access to.
• You suspect a leak. A key showed up in a screenshot, a public code repository, a shared doc, or anywhere it shouldn’t be. Revoke first, ask questions later — a revoked production key can’t be abused, and you can always issue a fresh one.
• A key is unused. If you can’t say what a key is for, retire it. Clear names (step 3) make this judgment easy.

To revoke: open API Keys, find the key by its name and prefix, and click Revoke. The dashboard asks you to confirm, because it can’t be undone. Any teammate can revoke any key in the Organization, so coordinate before retiring one others may depend on.

If you revoke a key in a panic and something breaks, that’s the right trade. Create a new key, give it to whatever stopped working, and you’re back. A live leaked key is a far bigger problem than a few minutes of downtime.

---

If this didn’t work

If you can’t create a key you expected to be able to, a freshly created key doesn’t authenticate, or you revoked one and aren’t sure what it broke, reach out.

Open a support ticket by emailing support@propsocket.io and include:

• Organization slug (the short name in your dashboard URL, e.g. acme-residential)
• The key’s name and prefix (e.g., ps_live_ — the prefix only, never the full key)
• What you expected vs. what you saw
• A screenshot of the API keys list if a button or key is missing

Please do not paste a full API key (ps_live_… or ps_test_…) into a ticket, a chat, or an email. The prefix and the key’s name are all we need to find it. If you’ve already shared a full key somewhere by accident, revoke it now (step 5) and then open the ticket.