Skip to main content
Use a short-lived, read-only organization API key to verify the production API without involving customer records.

​
1. Choose a safe organization

Use a designated test, demo, or sandbox organization in production. Do not smoke-test against a real customer’s records.

​
2. Create an API key

In Grain, open Settings → API → Create key.
  1. Name it for the test, such as Production API smoke test.
  2. Choose Read only.
  3. Choose a short expiry.
  4. Create the key and copy the secret immediately. Grain will not show it again.
Keep the key in a secrets manager or an ephemeral shell variable. Do not paste it into source code, screenshots, logs, or support messages.

​
3. Call the production API

The API key identifies its organization, so no organization header is needed. If you send X-Organization-Id, it must match the key.
A 200 response containing transaction data and pagination means authentication, organization inference, and read scope enforcement are working.

​
4. Verify lifecycle controls

For a complete smoke test:
  1. Rotate the key and save the new secret.
  2. Confirm both secrets work during the rotation window.
  3. Revoke the previous secret and confirm it returns 401.
  4. Revoke the named key and confirm the new secret also returns 401.
Invalid, expired, and revoked keys intentionally return the same generic 401 response. A valid key missing the required resource scope returns 403.

​
Building an app for users?

Use OAuth 2.1 when an application acts on behalf of a Grain user or needs to serve multiple organizations. OAuth follows the signed-in user’s role and requires X-Organization-Id on API requests.

​
Next steps

Last modified on July 13, 2026