API keys

Generate the public and secret key pair used by the WordPress plugin, deploy webhooks, and the public API.

6 min read

API keys let machines act on your Cache Rocket account: the WordPress plugin, a deploy webhook from your CI, or your own scripts calling the public API.

They live under Account → Account, in the API keys section.

The key pair

Public key
Identifies your account. It is not a secret in the cryptographic sense, but there is no reason to publish it either. Always visible in your account.
Secret key
Proves the request is genuinely from you. Treat it exactly like a password. Shown only once, right after you generate it.

Both are sent together on every authenticated machine request, usually as the X-Public-Key and X-Secret-Key headers.

Generating keys

  1. 1

    Open Account → Account

    Scroll to the API keys section.

  2. 2

    Click Generate new api keys

    A new pair is created immediately. Any previously issued pair stops working, so do this at a moment when you can update whatever depends on it.

  3. 3

    Click Reveal key straight away

    This is your one and only chance to read the secret. It is fetched once and then permanently hidden.

  4. 4

    Store the secret somewhere safe

    A password manager, or your CI provider's encrypted secrets store. Not a text file on your desktop, and not a chat message.

The secret is shown exactly once

If you navigate away before revealing it, or lose it later, there is no way to recover it. The only remedy is generating a new pair — which invalidates the old one and means updating every integration that used it.

Generation is rate limited

New keys can be generated once every five minutes. If you hit the limit, wait and try again.

Expiry

Keys carry an expiry date, shown next to them in your account. Once past it, requests using the pair are rejected and integrations relying on it stop working. Note the date somewhere you will actually see it, and rotate before you reach it rather than after.

Using your keys

With the WordPress plugin

Paste both keys into the plugin's settings screen after activating it. See WordPress plugin.

With deploy webhooks

Send them as headers on the webhook request:

bash
curl -X POST https://api.cacherocket.com/web/v1/public/webhooks/vercel \
  -H "Content-Type: application/json" \
  -H "X-Public-Key: YOUR_PUBLIC_KEY" \
  -H "X-Secret-Key: YOUR_SECRET_KEY" \
  -d '{"hostname":"www.example.com"}'

Full platform-by-platform setup is in Deploy triggers.

Triggering a warm directly

Some endpoints accept the keys in the request body instead of headers:

bash
curl -X POST https://cacherocket.com/api/wordpress/triggerWarm \
  -H 'Content-Type: application/json' \
  -d '{"publicKey":"YOUR_KEY","secretKey":"YOUR_SECRET","hostname":"example.com"}'

Keeping keys safe

  • Never commit the secret to a repository, even a private one. Use environment variables or your CI provider's secrets store.
  • Do not paste it into a support ticket, issue, or chat. No one at Cache Rocket needs your secret key to help you.
  • Do not put it in front-end code. Anything in a browser bundle is public, no matter how it is obfuscated.
  • Rotate immediately if exposure is even possible. Generating a new pair takes seconds; cleaning up after a leaked credential does not.

Rotating keys without downtime

Generating a new pair invalidates the old one at once, so there is no overlap window. Plan the swap:

  1. 1

    List everything that uses the current pair

    Typically the WordPress plugin, deploy webhooks in each hosting platform, and any CI jobs or scripts.

  2. 2

    Generate the new pair and reveal the secret

    Have your password manager open before you click.

  3. 3

    Update every consumer

    Work through the list. Integrations still holding the old keys are already failing at this point, so move promptly.

  4. 4

    Confirm each one works

    Re-save the WordPress plugin settings, fire a test deploy hook, and check that a warm run actually starts.

Common problems

I get a 401 or “unauthorized” from a webhook.
The keys are wrong, expired, or were replaced by a newer pair. Check for whitespace or a truncated value when the secret was copied, then confirm the expiry date in your account.
I lost the secret key.
It cannot be recovered. Generate a new pair and update every integration.
Reveal key does nothing, or says it was already revealed.
The secret for that pair has already been shown once and cannot be shown again. Generate a new pair.
Can I have several key pairs for different integrations?
An account uses one active pair at a time. To separate access between clients or environments, use separate workspaces — see Teams and roles.
Does generating new keys stop my warmers?
No. Warmers scheduled inside Cache Rocket keep running normally. Only external integrations that authenticate with the old keys are affected.