The gear menu in the console now has an API section. One click issues a key pair: the key stays visible and copyable, while the secret is shown once, at that moment. If you didn't save it, regenerating is the only way back — and regenerating replaces both immediately, so every call fails until your code carries the new pair. Don't do it mid-shift. The page also shows whether the credential is active and when it was last used, which is the fastest way to confirm your integration is really reaching us, and it's where you set or clear the callback URL (it has to start with http:// or https://). The full reference is linked at the bottom.