Skip to content
API, security & troubleshooting

Create and protect a workspace API key

Connect server-side software with scoped credentials and a safe rotation process.

CCorthex product guidesUpdated October 23, 20262 min read
Where to find itSettings → API keys / public developer docs
In this article

Before you begin

Use a test environment and the smallest necessary access. Keep workspace API keys and signing secrets on your server, outside browser code and public screenshots.

Example workspace · Demo data. Name the integration clearly. Never publish the generated secret. Select the image to enlarge it.
Create API Key dialog before any key is generated

Example workspace · Demo data. Name the integration clearly. Never publish the generated secret. Select the image to enlarge it.

Step by step

  1. 1

    Check availability and permission

    Open API keys in the correct workspace. Access may depend on your plan and role.

  2. 2

    Create a named key

    Use a label describing the integration/environment so you can identify it later. Copy the secret when the UI offers it and store it in a server secret manager.

  3. 3

    Test from your server

    Follow the Public REST API reference in this Help Center for exact endpoints, authentication and request schemas. Keep the key out of browser JavaScript, mobile bundles and chat prompts.

  4. 4

    Rotate when necessary

    Create and test a replacement, switch the integration, then revoke the old key. Revoke exposed keys promptly.

Concept diagram · A guide to the steps and their relationship; this is not a product screenshot.
Keep secrets on the server and verify requests and events

Concept diagram · A guide to the steps and their relationship; this is not a product screenshot.

Manage the workspace safely as it grows.

Settings are workspace-scoped. Use them to control people, billing, external connections, API keys and outbound event notifications.

Key hygiene: give every key a clear name, store it in a secret manager, use different keys per environment and revoke a key as soon as it is no longer needed. Corthex stores API keys as hashes, not plaintext.

AreaUse it for
MembersOrganisation access and team membership.
BillingSubscription, seat and usage management through Stripe.
ConnectionsExternal applications and commerce providers.
API keysDeveloper access tokens. Copy a new key immediately—its plaintext value is only shown once.
WebhooksSigned outbound event delivery with retry visibility.

Good to know

Public bot IDs identify agents for embedding; they are not substitutes for private API credentials. Do not publish key screenshots.

Check the result

Check the response, relevant delivery history and organisation scope. Use the Public REST API reference in this Help Center for the technical contract.

Questions & troubleshooting

The request is unauthorised

Check the documented authentication format, active key, workspace scope and plan access. Never paste the full key into a support message.

Was this article helpful?

Rate this guide on this device. Ratings are not sent to Corthex.