API keys: test vs live
Updated September 29, 2026
API keys authenticate requests to the Passmint API and any integration that talks to it. There are two kinds, and the key you use decides which mode you're operating in.
Test keys and live keys
- A key beginning with
pmk_test_operates in test mode. Passes it issues are watermarked and don't count toward your plan. - A key beginning with
pmk_live_operates in live mode. Passes it issues are real and count once installed.
There's no separate mode switch for the API. The prefix on the key is the mode. Build against a test key, then swap in a live key when you're ready.
Test keys are available on every plan, including Free. Live keys require a paid plan. See plans and pricing. You can still issue live passes from the dashboard on any plan; the paid gate is on the API.
Creating a key
Create keys in Developers → API keys. When you generate one, the full secret is shown only once. Copy it then and store it somewhere safe, like your secrets manager or your tool's credential settings. After that, the dashboard only ever shows the first few characters so you can recognize the key, never the full value again.
If you lose a key's secret, you can't reveal it again. Create a new key and revoke the old one rather than hunting for the original.
Scopes and expiry
When you create a key you can optionally limit what it can do and how long it lasts.
- Scopes restrict a key to specific areas: templates, passes, webhooks (each read or
write) and events (read; reading a single pass's events needs the passes scope). Choose Full access for an unrestricted key. A request
outside the key's scopes fails with
403 insufficient_scope, naming the scope it needed. - Expiry can be Never, 30, 90 or 365 days. After that date the key fails with
401 api_key_expired.
Keys created before these options existed are unrestricted and never expire. Scopes also limit what an AI assistant can do with the key.
Revoking and rotating
- Revoke a key to stop it working immediately. Any integration using it will stop authenticating, so swap in a replacement first.
- Rotate by creating a new key, updating wherever the old one is used, then revoking the old one. Doing it in that order avoids downtime.
The dashboard records when each key was last used, which helps you spot keys that are safe to retire.
Keep keys secret
Treat a live key like a password. It can issue, update, and void real passes.
- Never commit a key to source control or paste it into client-side code.
- Use separate keys for separate tools so you can revoke one without disrupting the rest. That includes an AI assistant.
- Rotate immediately if a key may have leaked.
To debug what a key is doing, see reading your API request logs.