Developer keys

API keys let your organisation's backend call the Wandura Delivery API. Members with the developer or admin role create, rotate and revoke keys themselves on the Developers screen of the partner portal. This page covers the portal side; for how to send a key with each request, see Authentication.

Open the Developers screen#

• Developers sign in straight to this screen; it is the only screen they have.
• Admins find it under Setup → Developers in the sidebar.

If you need this screen and do not see it, ask an admin of your organisation to give you the developer role. See Team and organisation.

Scopes#

Each key carries one or more scopes, and can only call the endpoints its scopes allow. Which scope opens which endpoint is in one table: Authentication · Scopes.

Warning: If a playback key leaks, anyone can stream your licensed films. Revoke it immediately. The portal shows this warning on the card and again next to the new key.

Create a key#

1. Open Developers.
2. Under Create a key, enter a Label that says where the key is used, for example cms-prod. Up to 80 characters.
3. Under What will this key do?, pick a purpose: Stream films in an app, Stream open video (fitness…) (asks you to pick an app), Sync catalog to your CMS or Receive creatives / webhooks. To choose scopes yourself, pick Advanced: choose scopes.
4. Press Create key.
5. Copy the key from the box that appears, using Copy key, and store it in your secrets manager.
6. Press I saved it to close the box.

Warning: The full key is shown only once. Wandura cannot show it again. If you lose it, rotate the key or create a new one.

Keep keys on your servers only. Never put a key in a browser page, a mobile app or a public repository.

The key list#

The Keys list shows every key of your organisation, newest first. For each key you see:

• The first characters of the key followed by …, and its label.
• Its scopes.
• Its status: Never used, Last used date and time, or Revoked.

Rotate a key#

Rotating replaces a key's secret and keeps its label and scopes.

1. Press Rotate on the key.
2. Confirm with Rotate key. The current secret stops working within seconds (see Security).
3. Copy the new key from the box that appears. As with a new key, it is shown only once.

Update your servers right after rotating: there is no overlap. A rotated key keeps its API version pin; a new key gets the latest version. You cannot rotate a revoked key. Playback keys rotate like any other key; to switch without downtime, create a second playback key, deploy it, then revoke the old one.

Revoke a key#

1. Press Revoke on the key.
2. Confirm with Revoke key.

New requests with the key are refused within seconds, and revoking cannot be undone. Tickets already issued keep playing until they expire (at most 30 minutes). The key stays in the list marked Revoked.

Warning: Revoking a playback key stops new playback in your apps within seconds. If you think the key has leaked, revoke it anyway, then create a new playback key for your servers and tell Wandura. The full runbook: Security · If a key leaks.

Next steps#

• Authentication
• API reference