Security

How API keys and assistant connections are stored, limited and revoked, what they can never do, and what reaches the marketplaces.

View as Markdown

API keys#

  • Shown once. A key (ssk_ and 40 characters) is shown only when it is created. We store a one-way hash of it and its first 12 characters, so we can tell keys apart but can never show the key again. Lost a key? Revoke it and create a new one.
  • One key, one shop. The key decides the shop; a request can't name another shop.
  • Up to 10 live keys per shop. Give each tool its own key, so you can revoke one without breaking the others.
  • Permissions. A key can have full access (the default), read only, or chosen permissions: catalog:read (always included), catalog:write, stock:write, promotions:write. A call outside them is refused with Y35.
  • Expiry. A key can expire after 30, 90 or 365 days, or never. The person who created it gets a reminder email 7 days before. An expired key is refused with Y22.
  • Revoke at any time in Settings → API keys. It stops working at once; the record is kept for the history.
  • Keep it secret. Only in the Authorization: Bearer header. Never in a URL, a shared file, a spreadsheet or a chat message.

Assistant connections#

  • You sign in with SellerSideKick, on our own page, and choose one shop and its permissions. The assistant never sees your password or an API key.
  • The assistant gets short-lived tokens limited to that shop and those permissions. We check the connection on every call.
  • Disconnect at any time in Settings → API keys → Connected AI assistants. The next call is refused.
  • The sign-in page says who is asking: the assistant's name, its web address, and a Verified badge only for assistants we know.

Who can do it#

  • Only a shop owner, or an admin with permission to manage API keys, can create keys or connect an assistant.
  • Keys and connections act in the name of the person who created them. Changes show that person in the history.
  • If that person leaves the shop, or loses the permission to manage API keys, their keys and connections stop working (Y34). Someone who still manages keys creates new ones.
  • Everything works only while the shop is on a monthly plan (such as Pro or Pro Plus). On Basic (pay-as-you-go coins), existing keys are kept but refused with Y31, and work again when the shop is back on a monthly plan.

What they can never do#

  • Delete anything. Products are created and updated, never deleted. Promotions are archived, never deleted.
  • Touch marketplace data. Only products on your SellerSideKick store and your own SellerSideKick promotions can be changed. A SKU that exists only on a marketplace, and every marketplace promotion, is refused.
  • Reach another shop.
  • See customers, chats or orders. The API and the connector cover the catalogue, stock and promotions only.

What reaches the marketplaces#

  • Stock reaches your linked Shopee, Lazada and TikTok listings, usually within about 10 minutes, exactly as a change in the dashboard does.
  • Prices, names, descriptions and promotions stay on your SellerSideKick store and chat bot. Marketplace prices and listings are edited in each seller center.

Seeing what changed#

Settings → API keys shows how many calls each key made today and in the last 30 days (calls, errors, rate-limited calls, dry runs, rows written), and a log of every change made through a key or an assistant: when, which key or assistant, the SKU or promotion code, the field, and its value before and after.

Report a problem#

Email team@kuztom.ai. If a key may have leaked, revoke it first.