Every request to the PocketPass API carries an API key. The key identifies your merchant, so it only ever reaches your own data.
Creating a key
- Open Settings → Developers.
- Create a key and give it a name that says where it will be used, for example "Membership site" or "Nightly sync".
- Copy the key immediately and store it somewhere safe.
The key is shown once, at the moment you create it. PocketPass stores only a hash of it, so nobody — including us — can show it to you again. If you lose it, delete the key and create another.
Keys look like gp_live_ followed by a long random string. Treat the whole thing as a password.
Sending the key
Put it in an Authorization header on every request:
Authorization: Bearer gp_live_your_key_here
If the header is missing, malformed, or names a key that has been deleted, the API replies 401.
Keeping keys safe
- Server-side only. Never put a key in a web page, a mobile app, or anything a golfer could view the source of. Anything in a browser is public, no matter how well hidden.
- One key per use. A separate key for each system means you can revoke one without taking the others down, and the name tells you what broke.
- Out of source control. Keep keys in environment variables or a secrets manager, never committed to a repository.
Rotating a key
Rotating means replacing a key with a new one while your integration keeps running:
- Create a new key in Settings → Developers.
- Deploy it to your system and confirm requests are working with it.
- Delete the old key.
Doing it in that order means there's no window where your integration has no working key.
If a key leaks
Delete it straight away in Settings → Developers. Deletion takes effect immediately and every request using that key starts failing with 401. Then create a replacement and deploy it. There's no need to contact us first — revoking is entirely in your hands.
Deleting a key doesn't change any data. Passes already issued, golfers, and house-account balances are untouched; only access through that key stops.