curl --request POST \
--url 'https://api.scanova.io/web-tracking/sites/7/api-keys/generate/' \
--header 'Authorization: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{"name": "Server key"}'
{
"id": 5,
"name": "Server key",
"prefix": "aZ3kP9x1",
"is_active": true,
"created": "2026-09-09T08:00:00+05:30",
"modified": "2026-09-09T08:00:00+05:30",
"key": "aZ3kP9x1F7q2...40-char-raw-key"
}
Web Tracking
Generate an API key
POST /web-tracking/sites//api-keys/generate/
POST
/
web-tracking
/
sites
/
{site_id}
/
api-keys
/
generate
/
curl --request POST \
--url 'https://api.scanova.io/web-tracking/sites/7/api-keys/generate/' \
--header 'Authorization: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{"name": "Server key"}'
{
"id": 5,
"name": "Server key",
"prefix": "aZ3kP9x1",
"is_active": true,
"created": "2026-09-09T08:00:00+05:30",
"modified": "2026-09-09T08:00:00+05:30",
"key": "aZ3kP9x1F7q2...40-char-raw-key"
}
Issues a new server-side API key for a tracking site. The raw key is returned once, in this response only — only its SHA-256 hash is stored, so it cannot be retrieved again afterward.
Requires the account’s
CONVERSION_TRACKING quota. A site may have at most 2 active keys at once — a 3rd attempt returns 400 with "You have reached the maximum limit of 2 active API keys for this tracking site.". Deactivate or delete an existing key first.integer
required
Tracking site ID.
string
Optional label to tell keys apart later (the list/retrieve endpoints only ever show the
prefix, not the full key).curl --request POST \
--url 'https://api.scanova.io/web-tracking/sites/7/api-keys/generate/' \
--header 'Authorization: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{"name": "Server key"}'
{
"id": 5,
"name": "Server key",
"prefix": "aZ3kP9x1",
"is_active": true,
"created": "2026-09-09T08:00:00+05:30",
"modified": "2026-09-09T08:00:00+05:30",
"key": "aZ3kP9x1F7q2...40-char-raw-key"
}
Store the
key field immediately — this is the only response that ever includes it. Use it as the value for the Conversion Tracking server-events API key header, not this Management API key.404 if site_id isn’t owned by this account; 400 if the 2-active-key limit is already reached.
Related
- List API keys
- Retrieve / update / delete an API key — deactivate an old key to make room for a new one.
- Management API overview — the auth scheme and quota architecture this endpoint is part of.
Authorizations
Send your Management API key as the raw value of the Authorization header — no "Bearer " or "Token " prefix, and no other characters. Example: Authorization: 401f7ac837da42b97f613d789819ff93537bee6a. A header containing more than one space-separated part is rejected outright. Requests also require the request's Host header to be the management API host (e.g. api.scanova.io) — the same key sent to the regular API host will not authenticate.
Path Parameters
Response
API key generated.
Was this page helpful?