> ## Documentation Index
> Fetch the complete documentation index at: https://closedloop.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage ClosedLoop AI API keys for the /v1 REST API: team-scoped and region-scoped, sent as the X-API-Key header on every request.

API keys authenticate requests to the ClosedLoop AI `/v1` [REST API](/docs/api-reference/introduction). Each key belongs to one team in one region, and everything it can read is limited to that team's data.

## Create a key

1. In the app, go to **Settings, API Keys**
2. Click **Create API Key**
3. Give it a descriptive name (for example "Analytics dashboard" or "Nightly ETL")
4. Copy the key immediately: it is shown only once

<Warning>API keys are shown only once when created. Store them securely, for example in your secret manager. If you lose a key, revoke it and create a new one.</Warning>

## Use the key

Send the key as an `X-API-Key` header on every request:

```bash theme={null}
curl https://api.closedloop.sh/v1/insights \
  -H "X-API-Key: clai_live_xxxxxxxxxxxxxxxxxxxx"
```

Two properties of every key:

* **Team-scoped**: the key belongs to your team, and every response is automatically limited to your team's data. A key can never read another workspace.
* **Region-scoped**: each team lives in exactly one region, so use the matching base URL. A key issued in the EU only works against `https://eu.api.closedloop.sh/v1`; a US key only works against `https://api.closedloop.sh/v1`.

Requests are rate-limited per key by plan. See [Conventions](/docs/api-reference/conventions) for limits, pagination, and error shapes.

## Keep keys server-side

Treat an API key like a password. Call the API from your servers, scheduled jobs, and ETL pipelines. Never embed a key in client-side code, mobile apps, or public repositories, where anyone can extract it.

## Revoke a key

Click the revoke button next to any key in **Settings, API Keys**. Revoked keys stop working immediately: anything still using that key receives `401` responses until it is reconfigured with a new key.

## Security

* Keys are hashed (SHA-256) before storage: ClosedLoop AI cannot retrieve your key after creation
* Each key is scoped to one team: it cannot access other workspaces
* Rotate keys periodically, especially after team member departures

## Webhook signing secrets

Webhook signing secrets are a separate credential from REST API keys. Inbound [webhook ingestion](/docs/integrations/webhooks) verifies each payload with an HMAC-SHA256 signature computed from a dedicated **Webhook Key**, generated on the same **Settings, API Keys** page. You configure that secret in the source platform that sends the webhooks.

Keep the two roles separate: use REST API keys for reading the `/v1` API, and your Webhook Key for signing inbound webhook payloads. See [Webhook ingestion](/docs/integrations/webhooks) for endpoint URLs, signature headers, and setup steps.