---
title: "API Keys"
description: "Create, scope, and revoke Chatvox API keys, and keep them secure."
---

:::note[Plan]
API keys are available on the **Standard** plan and above. Only team **Owners** and **Admins** can create and revoke them.
:::

Every API request needs a key. Send it as a bearer token:

```
Authorization: Bearer cvx_...
```

## Create a key

1. **Open API & webhooks**

    Go to **Team settings**. Next to **API & webhooks**, select **Manage**.

2. **Create the key**

    Under **API keys**, select **Create key** and name it after the system or client that will use it, such as "Zapier" or "Acme website".

3. **Choose its access**

    - **All agents**: the key can reach every agent in the team, including agents you create later.
    - **Selected agents**: the key can only reach the agents you tick. Use this when you give a key to a client or connect one integration to one agent.

4. **Copy the key**

    The key is shown **once**. Copy it into your system's settings or a secret manager. If you lose it, revoke it and create a new one.

The key list shows each key's name, the first characters of the key, which agents it can reach, who created it, and when it was last used.

## Keys for agencies and clients

If you run agents for several clients in one team, create one key per client with **Selected agents**. A client's key can't see or use other clients' agents: requests for them return `404 Not found`, exactly as if those agents didn't exist.

Keep an **All agents** key for your own automation, such as sending every lead to your CRM.

## Revoke a key

Select **Revoke** next to the key. Requests using it stop working immediately with `401 invalid_api_key`.

You can't change an existing key's access. To change it, create a new key and revoke the old one.

## Keep keys secure

:::warning
An API key can read your agents' leads and conversations and send messages that use your credits. Treat it like a password.
:::

- Only use keys from a **server** or an automation tool. Never put a key in website JavaScript, a mobile app, or a public repository.
- Store keys in environment variables or a secret manager, for example as `CHATVOX_API_KEY`.
- Use one key per system, so you can revoke one without breaking the others.
- Revoke keys you no longer use. The **last used** time helps you find them.

Chatvox stores only a fingerprint of each key, not the key itself. Creating and revoking keys is recorded in your team's activity log.