HHostingByteSoftware
Ctrl K
ComunidadGuías…

docs/api-keys.mdx

Rama main · réplica de lectura del repositorio original.

Archivo original ↗Preguntar a KiBot
---
title: "Find or replace your license / API key"
description: "Where to create the wm_ key requested by the desktop app or API, which plans include one, and what to do if the full key is no longer visible."
---

World Monitor calls this value a **license key** in some desktop screens and an **API key** elsewhere. They refer to the same user-created value, which starts with `wm_`.

<Info>
Checkout does not create a reusable key for you. **API Starter and API Business** subscribers create their own keys after signing in. **Dashboard Pro and Pro Business do not include API keys**; they include [desktop keys](#desktop-keys) instead, which work in the desktop app and on self-hosted dashboards but not on the API. Pro subscribers can also use the signed-in web dashboard and connect supported MCP clients with OAuth.
</Info>

## Create a key

1. Open the [World Monitor dashboard](https://www.worldmonitor.app/dashboard) and sign in with the account that owns the API subscription.
2. Select **Settings** in the top-right corner.
3. Open the **API Keys** tab.
4. Enter a name such as `desktop` or `my-app`, then select **Create Key**.
5. Copy the complete `wm_...` value immediately and store it in a password manager or secret manager.

The full key is shown only once. World Monitor stores a one-way hash, not the plaintext key.

## If you can see only the prefix

The API Keys tab lists a short prefix so you can identify each key, but it cannot reveal the complete value again.

1. Revoke the key whose full value you lost.
2. Create a replacement.
3. Update every app or script that used the old key.

Revocation is permanent. Applications using the old key will stop working.

## Use the key in the desktop app

In the World Monitor desktop app, open **Settings → Overview**, paste the complete value into **License / API Key**, then select **Save & Close**.

For API requests, send the same value in the `X-WorldMonitor-Key` header. See the [API quickstart](/usage-quickstart) for examples.

A key from either API plan can call the Pro-gated REST routes, such as `list-comtrade-flows`, `get-tariff-trends`, `get-bilateral-tariff`, `get-us-import-duty`, `get-country-products`, and `get-route-impact`. You do not need a separate Pro subscription for them. See [Authentication & Usage](/usage-auth).

## Desktop keys

A desktop key is a `wm_` key for the desktop app and for self-hosted dashboards. It unlocks the same Pro data as signing in to the dashboard, so a self-built desktop copy or a self-hosted web install can load Pro cloud data without a browser sign-in. It uses the same `wm_` format as an API key; the server records that it is a desktop key when you create it.

**Who gets one.** Pro includes 2 desktop keys and Pro Business includes 3. Free accounts cannot create them. The key is for the subscriber only: one named user, on that person's own desktop copies and in that person's own browser on a self-hosted dashboard. On a shared self-hosted dashboard, each user enters their own key; an operator cannot buy one key that unlocks Pro for every visitor. An [API plan](/pricing) is for calling the API directly, not for unlocking a shared dashboard.

**Not for scripts.** A desktop key is licensed for the desktop app and self-hosted dashboards only. Scripts, notebooks, bots, integrations and any commercial use need an [API plan](/pricing): API Starter for your organization's internal tools, API Business for customer-facing products. Requests from other clients are refused with a 403 that says so.

**Where it works.** The official desktop app, desktop builds you compile yourself, and self-hosted web installs (Docker or native) built from a release that includes the desktop-key relay. In the desktop app, the key lives in the OS keychain. API Starter and API Business keys also work in the desktop app, but not on a self-hosted dashboard: it accepts desktop keys only and reports an API key as not a desktop key.

**On a self-hosted dashboard.** Each browser user enters their own key in the dashboard's Settings. The install's server checks it with World Monitor and keeps it in an HttpOnly cookie in that browser for 30 days, after which you enter it again. Pro panels unlock only after World Monitor confirms the key. The server then forwards that browser's Pro requests to World Monitor with the key, and they count against the same daily and per-minute ceiling as the owner's desktop app. Other requests stay on the install, and a browser with no key stays on the free dashboard. The operator can turn the relay off; the setting then says so. The install's server sees your key when it forwards requests, so create a separate desktop key for any install you do not run yourself, and revoke it on [worldmonitor.app](https://www.worldmonitor.app) when you stop using or trusting that install.

**Limits.** Each account has a ceiling of 7,500 desktop-key requests per day and 120 per minute, shared across all of its desktop keys. Past the ceiling, requests return a rate-limit response until the next UTC day. Revoking and recreating a key does not reset the count.

**What it cannot reach.** A desktop key does not work on `/api/v2/` paths, shipping webhooks, the MCP endpoint, or OAuth key grants. Those need an API Starter or API Business key.

**Create one.** Sign in at [worldmonitor.app](https://www.worldmonitor.app), open **Settings → API Keys**, enter a name such as `desktop`, and select **Create desktop key**. Copy the full value at once; it is shown only one time. Creating a key past your plan's limit shows a message with the cap.

**Use it.** In the desktop app, open **Settings → Overview**, paste the key into **Desktop key**, then select **Save & Close**. On a self-hosted dashboard, open Settings and enter the key in the desktop key section. You do not need to sign in to the dashboard.

**If your subscription lapses.** Desktop keys are denied while the subscription is not active, the same way a lapsed API key is. Nothing is revoked: when you renew, the same keys work again.

**Revoke.** Revoke a key from the same tab. Revocation is permanent. The desktop app using it stops loading Pro data, and a self-hosted dashboard using it locks its Pro panels.

## If the API Keys tab asks you to upgrade

API keys require an active **API Starter** or **API Business** subscription. A Dashboard Pro or Pro Business subscription unlocks dashboard and MCP features and includes [desktop keys](#desktop-keys), but it does not include API-key creation.

If you already bought an API plan, confirm that you signed in with the account that owns the subscription. If the plan is still not recognized, email [support@worldmonitor.app](mailto:support@worldmonitor.app) from the purchase email address. Include the plan name and, if available, only the short key prefix—**never send a complete key**.

## Related

- [Accounts & Sign-up](/accounts)
- [Plans & Pricing](/pricing)
- [Authentication & Usage](/usage-auth)
- [Support & Contact](/support)