# 1. Integration key

> How to create a secret key and grant it permissions.

An integration key is a long-lived secret that is exchanged for a short-lived access token.

## Create a key

1. Open **Settings → Company**.

   ![Settings menu: the “Company” item](/_astro/01-settings-menu.M_Y39WoE_29Rh0n.webp)

2. Go to the **Integration keys** section.

   ![Company settings: the “Integration keys” card](/_astro/02-company-settings.DCrjaya__ZY7Xo8.webp)

3. Click **New key** and enter a name — for example, `online-store` or `1C exchange`.

   ![The “New key” button above the list of keys](/_astro/03-new-key-button.D2H1iw0c_2jxnfa.webp)

   ![New key form: the “Key name” field](/_astro/04-key-name.D_xTGvOe_Z181Doa.webp)

4. Copy the key from the list.

   ![List of keys: the copy button in the “Actions” column and the notification “Integration key copied successfully”](/_astro/05-copy-key.Dbg-wu0N_Z25pxN.webp)

Together with the key, its **role** is created — it already includes two permissions: “View and search products in the catalog” and “Ability to view the customer list”.

Which methods are available to the key — see the [list of routes](/en/reference/permissions/); what each role access toggle changes — see [key role permissions](/en/reference/role-permissions/). If a method responded with `403`, see [understanding 403 and 404](/en/troubleshooting/403-and-404/).

> **The key requires the same protection as a password**
>
> The key grants access to all company data within the granted permissions. It must not end up in front-end code, in the repository or in build variables available to contractors. A compromised key is handled by deleting it and issuing a new one.

Next: [first request](/en/start/first-request/).