Important: Treat an API key like a password. Anyone with the key can use the access assigned to it.
Before You Start
Only users with the appropriate API Key permissions can view and manage API keys. You'll find them under System Setup > API Keys. API keys are only visible once enabled by your OnRent Go Account Manager.
If API access has been enabled but you can't see this option, ask your OnRent Go administrator to check your role permissions.
Before creating a key, confirm which areas of OnRent Go and which actions the integration needs. API keys apply across all the depots and regions in your subscription — access to individual resources and actions is controlled through the privileges assigned to the key.
Creating an API Key
From the API Keys screen:
Click New API Key.
Enter a unique Name for the key. Use a name that identifies the integration and environment, such as "Website Integration – Production".
Add an optional Description to record what the key is used for.
Enter an optional future Expiry Date. If no date is entered, the key will not expire automatically.
Configure the key's Privileges.
Privileges are grouped by area and can include:
Create – add new records.
Read – retrieve or view records.
Write – update existing records.
Delete – remove records.
Allow – perform additional actions relating to that area.
Everything starts switched off. Enable only the privileges the integration requires. A key with everything switched off can be created, but it won't have usable access to OnRent Go data — so make sure the required privileges are selected.
Once the details are complete, click Create API Key.
Confirming the Creation
For security, OnRent Go will ask you to re-enter your current password. Enter your password and click Confirm.
Once the key has been created, its full value is displayed. Click Copy to Clipboard and store the key in a secure password manager or secret store before clicking Done.
Important: The full API key is shown only once. After this window is closed, OnRent Go displays only a masked version of the key — it cannot be retrieved again. If the key is lost, it must be rotated or replaced.
The key can now be provided securely to the person or system responsible for configuring the integration.
Viewing and Editing API Keys
The API Keys screen shows each key's Name, masked key, creation date, expiry date and status.
Select an active key to update its name, description, expiry date or privileges, then click Save Changes.
Changes to privileges take effect for future API requests. Removing access that an integration currently uses may cause that integration to stop working. Expired keys cannot be updated or reactivated.
API Documentation
Click API Documentation at the top of the API Keys screen to open the protected OnRent Go API documentation in a new browser tab.
The documentation can be shared with the developer configuring the integration. If it doesn't open, allow pop-ups for OnRent Go and try again.
Monitoring an API Key
Open the actions menu against a key and select View Inspector. The Inspector includes:
Overview – request volumes, errors, response times and response payload information.
Request Log – individual requests, including the request path, response status, response time and source IP address.
Action Log – actions performed in OnRent Go using the key.
You can change the reporting period and refresh the information. This is useful when checking whether an integration is connecting successfully, or investigating failed requests.
Rotating an API Key
Rotation replaces the secret for an existing active key while retaining its details and privileges.
To rotate a key:
Open its actions menu.
Select Rotate Key.
Confirm the action and re-enter your password.
Copy and securely store the new key before clicking Done.
Update the connected integration with the new key.
Important: Rotation immediately invalidates the previous key. There is no overlap period, so coordinate the change with whoever manages the integration.
Cloning an API Key
Select Clone Key to create a separate key based on an existing one. This is useful when another integration requires the same privileges without sharing the same secret.
After confirming your password, the new key is displayed once. The clone copies the original description and privileges. Its name includes "(Clone)", and no expiry date is carried over, so review the cloned key's name, expiry and privileges before using it.
Expiring an API Key
When a key is no longer required, open its actions menu and select Expire Key.
After you confirm the action and re-enter your password, the key is permanently deactivated. Any integration using it will immediately lose access.
Important: Expiring a key cannot be undone. OnRent Go retains the expired record for visibility, but the key cannot be restored or rotated.
Recommended Security Practices
Create a separate key for each integration and environment.
Assign only the privileges the integration genuinely needs.
Store full keys in a password manager or secret store.
Never place a key in notes, screenshots or unsecured emails.
Set an expiry date where appropriate.
Use the Inspector to monitor activity and errors.
Rotate a key immediately if it may have been exposed.
Expire keys that are no longer being used.
Summary
Once API access is enabled, API keys are created and managed from System Setup > API Keys. Each key has its own privileges, optional expiry and activity information. The full secret is displayed only once, so it must be copied and stored securely before leaving the creation, cloning or rotation screen.