Skip to main content
API keys authenticate requests to the ClosedLoop AI /v1 REST API. Each key belongs to one team in one region, and everything it can read is limited to that team’s data.
For machine-to-machine MCP access, create a service client. Regular API keys do not work with MCP.

​
Create a key

  1. In the app, go to Settings, API Keys
  2. Click Create API Key
  3. Give it a descriptive name (for example “Analytics dashboard” or “Nightly ETL”)
  4. Copy the key immediately: it is shown only once
API keys are shown only once when created. Store them securely, for example in your secret manager. If you lose a key, revoke it and create a new one.

​
Use the key

Send the key as an X-API-Key header on every request:
Two properties of every key:
  • Team-scoped: the key belongs to your team, and every response is automatically limited to your team’s data. A key can never read another workspace.
  • Region-scoped: each team lives in exactly one region, so use the matching base URL. A key issued in the EU only works against https://eu.api.closedloop.sh/v1; a US key only works against https://api.closedloop.sh/v1.
The public API currently has no fixed published per-key quota. See Conventions for pagination and error shapes.

​
Keep keys server-side

Treat an API key like a password. Call the API from your servers, scheduled jobs, and ETL pipelines. Never embed a key in client-side code, mobile apps, or public repositories, where anyone can extract it. Incremental /insights cursors are bound to the exact API key that created them. If you rotate a key during an export, restart with the new key from the last fully committed sync_until checkpoint.

​
Revoke a key

Click the revoke button next to any key in Settings, API Keys. Revoked keys stop working immediately: anything still using that key receives 401 responses until it is reconfigured with a new key.

​
Security

  • Keys are hashed (SHA-256) before storage: ClosedLoop AI cannot retrieve your key after creation
  • Each key is scoped to one team: it cannot access other workspaces
  • Rotate keys periodically, especially after team member departures

​
Webhook signing secrets

Webhook signing secrets are a separate credential from REST API keys. Inbound webhook ingestion verifies each payload with an HMAC-SHA256 signature computed from a dedicated Webhook Key, generated on the same Settings, API Keys page. You configure that secret in the source platform that sends the webhooks. Keep the two roles separate: use REST API keys for reading the /v1 API, and your Webhook Key for signing inbound webhook payloads. See Webhook ingestion for endpoint URLs, signature headers, and setup steps.