A Dodo key that can only read
This is the one provider here where getting the key right is entirely your job, and this page is specific about why.
One checkbox, set once, and not editable later
In Dodo Payments, go to Developer, then API keys, and create a key with "Enable write access" left unchecked. That setting is real: a key made that way can fetch payments, subscriptions, customers and products, and cannot create or modify anything.
It is decided at creation. There is no per-resource scope list to get right, no way to narrow a key afterwards, and no way to widen one either — which makes this simultaneously the simplest key here to create and the only one whose permissions you can never look up again.
- Where
- Developer, API keys
- The setting
- "Enable write access", left unchecked
- Granularity
- All or nothing — there is no per-resource scope
- Changing it later
- Not possible — make a new key instead
What a read-only Dodo key costs you here, and what it does not
Nothing, is the short answer. Because permissions are all-or-nothing, there is no partial state to land in: payments power every revenue figure on the site — the headline total, the trend, refunds, revenue by product and by country, and the orders table itself, subscriptions power monthly recurring revenue, the active and cancelling counts, the subscription mix and the subscriptions table, customers power the buyer name and email on an order at a provider that does not put them on the order itself, and the mirrored customer records, products power the products table — what you sell, with what it has earned beside it wherever the provider attaches a product to an order, and a read-only key reads all four.
The one gap is not a permission at all. Dodo's payments list carries no product, so revenue cannot be attributed per product for a Dodo business no matter what the key can do. That is a shape-of-the-API limit, not something a wider key would fix.
Verifying it, and why you cannot
You cannot, and neither can we. A key created with write access and one created without it look identical to anything holding it — the prefix says live or test and nothing more. The capability probe that reports what a Stripe or Paddle key can read has nothing to report here beyond "all four", which it would say either way.
The honest consequence is that unticking the box is the whole of the guarantee, and it is yours. If you are not certain a key was made that way, the only way to become certain is to make a new one, because there is nothing to inspect on the old one.
Replacing or revoking the key
There is no replace-the-key screen today, and this page is not going to imply one. Changing the credential means disconnecting the account here and connecting it again with the new one. Disconnecting deletes the mirrored copy of that account's rows, which is why it is confirmed in place with a sentence naming exactly what goes; the first sync after reconnecting rebuilds it from Dodo Payments. Nothing is lost permanently, but it is a rebuild rather than a swap, so do it when you can wait for a sync.
Revoking the key at Dodo Payments without reconnecting is the gentler case: the account and its last-synced figures stay exactly where they are, and the failure is recorded against it rather than silently swallowed.
While it is stored, the key is encrypted with AES-256-GCM under a per-value random initialisation vector before it reaches the database, and decrypted only inside the sync. Nothing derived from it beyond a short hint is ever sent to the browser.
