# API access and vendor grants

> Give a vendor a scoped key and let their software pull — you never export for them again.

Source: https://geodb.io/guide/topic/api_keys_protocol/ · Category: Sharing your data
The endgame of "stop touching your data": when a third party — an AI
targeting vendor, a resource consultant, an auditor's data team — needs
your project data *in their system*, you don't export and email. You
grant access, and their software pulls.

## Vendor grants

The **access grants** page issues scoped, revocable credentials: label
the grant ("Acme targeting — 2026"), set an expiry and a rate limit, and
create it. The token is shown once — hand it to the vendor through your
own channel. From then on their software pulls what the grant allows,
every pull is logged (you can see who pulled what, when), and when the
engagement ends you revoke the grant. No shared passwords, no
please-find-attached.

## What they can pull

Project data in formats data teams actually want — tabular data,
geospatial layers, and rasters — through a documented interface: the
full, current reference lives in-app under **API docs**. Your data stays
in your database; vendors read through the window you opened, at the
rate you allowed, until the date you set.

## Your own keys

Your personal API tokens (the same kind the QGIS plugin uses) are listed
on your account page. Grants are for organisations and software; personal
tokens are for you.

## Why this beats exporting

An export is a snapshot with your name on it and no memory of where it
went. A grant is scoped, logged, rate-limited, expiring, and revocable —
and always serves *current* data. When the vendor asks for "the latest",
the answer is: you already have it.