# Security

> How API keys and assistant connections are stored, limited and revoked, what they can never do, and what reaches the marketplaces.

## API keys

- **Shown once.** A key (`ssk_` and 40 characters) is shown only when it is created. We store a one-way hash of it and its first 12 characters, so we can tell keys apart but can never show the key again. Lost a key? Revoke it and create a new one.
- **One key, one shop.** The key decides the shop; a request can't name another shop.
- **Up to 10 live keys per shop.** Give each tool its own key, so you can revoke one without breaking the others.
- **Permissions.** A key can have full access (the default), read only, or chosen permissions: `catalog:read` (always included), `catalog:write`, `stock:write`, `promotions:write`. A call outside them is refused with `Y35`.
- **Expiry.** A key can expire after 30, 90 or 365 days, or never. The person who created it gets a reminder email 7 days before. An expired key is refused with `Y22`.
- **Revoke at any time** in **Settings → API keys**. It stops working at once; the record is kept for the history.
- **Keep it secret.** Only in the `Authorization: Bearer` header. Never in a URL, a shared file, a spreadsheet or a chat message.

## Assistant connections

- **You sign in with SellerSideKick**, on our own page, and choose one shop and its permissions. The assistant never sees your password or an API key.
- The assistant gets **short-lived tokens** limited to that shop and those permissions. We check the connection on every call.
- **Disconnect at any time** in **Settings → API keys → Connected AI assistants**. The next call is refused.
- The sign-in page says who is asking: the assistant's name, its web address, and a **Verified** badge only for assistants we know.

## Who can do it

- Only a shop owner, or an admin with permission to manage API keys, can create keys or connect an assistant.
- Keys and connections act **in the name of the person who created them**. Changes show that person in the history.
- **If that person leaves the shop**, or loses the permission to manage API keys, their keys and connections stop working (`Y34`). Someone who still manages keys creates new ones.
- Everything works only while the shop is on a **monthly plan** (such as Pro or Pro Plus). On Basic (pay-as-you-go coins), existing keys are kept but refused with `Y31`, and work again when the shop is back on a monthly plan.

## What they can never do

- **Delete anything.** Products are created and updated, never deleted. Promotions are archived, never deleted.
- **Touch marketplace data.** Only products on your SellerSideKick store and your own SellerSideKick promotions can be changed. A SKU that exists only on a marketplace, and every marketplace promotion, is refused.
- **Reach another shop.**
- **See customers, chats or orders.** The API and the connector cover the catalogue, stock and promotions only.

## What reaches the marketplaces

- **Stock** reaches your linked Shopee, Lazada and TikTok listings, usually within about 10 minutes, exactly as a change in the dashboard does.
- **Prices, names, descriptions and promotions** stay on your SellerSideKick store and chat bot. Marketplace prices and listings are edited in each seller center.

## Seeing what changed

**Settings → API keys** shows how many calls each key made today and in the last 30 days (calls, errors, rate-limited calls, dry runs, rows written), and a log of every change made through a key or an assistant: when, which key or assistant, the SKU or promotion code, the field, and its value before and after.

## Report a problem

Email team@kuztom.ai. If a key may have leaked, revoke it first.