Facts reviewed: 2026-10-20

Developer access is owner-controlled and off by default. It is separate from the browser SDK and the **API Keys** page used for server event ingestion.

## Enable and create a key

1. Select the correct app in the console.
2. Open **Settings → Developer mode** and enable the master switch.
3. Enable **API access**.
4. Create a developer key with a descriptive integration name, the minimum scopes, and an expiry.
5. Copy the secret immediately into your server's secret store. It is only returned once.

Keys can last 1 hour, 24 hours, 7 days, or until revoked. Pro permits `stats:read`; Business and Custom also permit `events:read` and `ai:prompt`. AI requests have additional feature and credit checks.

| Scope         | Use                               |
| ------------- | --------------------------------- |
| `stats:read`  | Aggregate reports and charts      |
| `events:read` | Bounded privacy-safe event export |
| `ai:prompt`   | Questions to Owleye Analytics's AI analyst  |

`events:write` belongs to a different ingestion key type. See the [API reference](/docs/api/) for endpoint authentication, request examples, and rate limits.

## Disable or rotate

Disabling Developer mode or API access makes existing developer keys unusable immediately without deleting them. Re-enabling access restores eligible keys; revocation permanently disables the selected key. For rotation, create a replacement, deploy it to the integration, verify it, then revoke the old key.

## Console downloads

While Developer mode is enabled, Settings can download a JSON control-plane backup containing app metadata, allowed origins, rules, settings, and custom dashboard definitions. It excludes analytics facts, users, sessions, TOTP secrets, API keys, and credential hashes.

Paid accounts also have owner-authenticated event exports within their retained export window. For repeatable automation, use a developer key and the documented paginated event API instead of copying a console session cookie.