API Keys
Create, scope, and revoke Chatvox API keys, and keep them secure.
Every API request needs a key. Send it as a bearer token:
Authorization: Bearer cvx_...Create a key
Open API & webhooks
Go to Team settings. Next to API & webhooks, select Manage.
Create the key
Under API keys, select Create key and name it after the system or client that will use it, such as “Zapier” or “Acme website”.
Choose its access
- All agents: the key can reach every agent in the team, including agents you create later.
- Selected agents: the key can only reach the agents you tick. Use this when you give a key to a client or connect one integration to one agent.
Copy the key
The key is shown once. Copy it into your system’s settings or a secret manager. If you lose it, revoke it and create a new one.
The key list shows each key’s name, the first characters of the key, which agents it can reach, who created it, and when it was last used.
Keys for agencies and clients
If you run agents for several clients in one team, create one key per client with Selected agents. A client’s key can’t see or use other clients’ agents: requests for them return 404 Not found, exactly as if those agents didn’t exist.
Keep an All agents key for your own automation, such as sending every lead to your CRM.
Revoke a key
Select Revoke next to the key. Requests using it stop working immediately with 401 invalid_api_key.
You can’t change an existing key’s access. To change it, create a new key and revoke the old one.
Keep keys secure
- Only use keys from a server or an automation tool. Never put a key in website JavaScript, a mobile app, or a public repository.
- Store keys in environment variables or a secret manager, for example as
CHATVOX_API_KEY. - Use one key per system, so you can revoke one without breaking the others.
- Revoke keys you no longer use. The last used time helps you find them.
Chatvox stores only a fingerprint of each key, not the key itself. Creating and revoking keys is recorded in your team’s activity log.