API Keys

Create API Key

Generate keys in Dashboard → Settings → API Keys. Production keys use the kc_live_ prefix and are shown only once.

Rotate API Key

Create a new key, update your applications, then revoke the old key. KorClaw supports overlapping keys during rotation.

Revoke API Key

Revoked keys fail immediately with 401 Unauthorized. Revocation is irreversible.

Environment separation

• Use a separate API key for development and staging
• Use kc_live_ keys in production only
• Never share keys across environments

Best practices

• Store keys in environment variables or a secrets manager
• Never commit keys to git or client-side code
• Rotate keys on a regular schedule
• Use scoped keys with minimum required permissions