Consent Docs
Open console

Approve live keys

Review a customer's request to go live and approve or decline it in the Platform area of the console, or with the platform key of your deployment.

How-to2 min readFor project administrators and deployment operators

Customers can create test keys only. When one chooses Request to go live on the Install page, the key waits for you. Approve it to switch the same key string to live.

In the console#

People of the platform organization open Live keys in the Platform area. It lists the requests, oldest first, with Approve and Decline. Your name is recorded on the key. You need Consent.PlatformServices.fetchLiveKeyRequests to see them and Consent.PlatformServices.reviewLiveKeyRequests to decide.

The steps below do the same with the platform key, for scripts.

Before you start#

  • The API has your own key in PLATFORM_API_KEYS, or the shared PLATFORM_API_KEY. Without either, these endpoints answer 503 and no key can go live.
  • Your shell holds your key in PLATFORM_API_KEY.
  • With your own key, each approval records your name. To remove someone's access, delete their entry and restart the API.

Review a request#

  1. List the requests that wait for review, oldest first.

    Shell
    curl -s \
  https://consent.example.in/api/v1/api/platform/sdk-key/pending \
  -H "X-Piedap-Platform-Key: $PLATFORM_API_KEY"

  2. Read the entry and check the fields in what to check. Copy its id.

  3. To approve, send the id with an optional note.

    Shell
    curl -s -X POST \
  https://consent.example.in/api/v1/api/platform/sdk-key/approve/<id> \
  -H "X-Piedap-Platform-Key: $PLATFORM_API_KEY" \
  -H "X-Piedap-Platform-User: priya.nair" \
  -H "Content-Type: application/json" \
  -d '{"note":"Origins match the property"}'

  4. To decline, send the reason as the note. The customer sees it.

    Shell
    curl -s -X POST \
  https://consent.example.in/api/v1/api/platform/sdk-key/decline/<id> \
  -H "X-Piedap-Platform-Key: $PLATFORM_API_KEY" \
  -H "X-Piedap-Platform-User: priya.nair" \
  -H "Content-Type: application/json" \
  -d '{"note":"The allowed origin does not match the property"}'

An approval answers 200 with SDK_KEY_LIVE_APPROVED. The customer's key shows Live and nothing has to be reinstalled. A decline answers 200 with SDK_KEY_LIVE_DECLINED. The key stays a test key and shows Declined with your reason.

X-Piedap-Platform-User names the reviewer and is stored on the key. Without it the reviewer is platform.

What to check#

The list never holds the key itself, only a hint such as pk_…Nimw.

Field Check
property.origins and allowedOrigins The key's origins belong to the site or app of the property
property.type A mobile key lists app:<id>, not a web origin
hasSecret A key with no origins must have a secret, or it cannot be used once live
liveRequestNote What the customer wrote

Answers#

Answer Meaning
200 SDK_KEY_LIVE_APPROVED The key is live. A key on the test limit of 600 requests a minute moves to 6,000
200 SDK_KEY_LIVE_DECLINED The key stays a test key
400 SDK_KEY_NEEDS_ORIGIN The key has no allowed origin, app id or secret
400 SDK_KEY_DECLINE_NEEDS_NOTE The note of a decline was blank
400 with no code A decline without a note, a note over 500 characters, or an id that is not a UUID
401 PLATFORM_KEY_INVALID Wrong platform key
404 SDK_KEY_NOT_FOUND No such key, or it is revoked or disabled
409 SDK_KEY_ALREADY_LIVE Nothing to do
409 SDK_KEY_LIVE_NOT_REQUESTED A decline needs a waiting request. An approval does not
503 PLATFORM_API_DISABLED PLATFORM_API_KEY is not set

Approvals and declines are written to the audit log table. They carry no project, so customers do not see them on their Audit page.

↑↓ to move, Enter to open