API keys and permission scopes
Create, restrict, rotate, disable, and delete API keys for one Clan Labs community.
Last updatedCreate keys in Settings → API Keys. A community can hold up to 25 keys, and a key name can contain up to 64 characters. The dashboard offers Read-only, Member management, Full access, and custom permission selections.
The full secret is displayed once. After the modal closes, the dashboard shows only safe metadata such as the key’s name, prefix, state, dates, and permission count.
Available scopes
| Scope | Allows |
|---|---|
members.read | List members and fetch a member profile. |
members.experience.write | Add, remove, or set member experience through the supported operation. |
members.quota.write | Add, remove, or set member quota points. |
members.ranks.write | Set, promote, or demote a Roblox member rank. Pro required. |
members.medals.write | Award or remove member medals. |
members.qualifications.write | Award or remove member qualifications. |
members.suspensions.write | List, create, restore, or cancel member suspensions. |
ranks.read | List ranks or fetch one by Roblox role resource ID. |
medals.read | List medals or fetch one by name. |
qualifications.read | List qualifications or fetch one by name. |
blacklists.read | List or fetch user and group blacklist entries. |
blacklists.write | Create, edit, or remove blacklist entries. |
warnings.read | List or fetch warning records. |
warnings.write | Issue, edit, or delete warnings. |
events.read | List events, types, and locations or fetch one event. |
events.write | Create, announce, finish, or cancel events. |
applications.read | List forms and read application metadata. |
applications.write | Manage forms and read editable configuration, including answer keys. |
applications.submit | Open forms, submit for verified applicants with their explicit consent, and check results. |
applications.responses.read | Read submitted answers and private staff notes. |
applications.responses.review | Pass or fail a pending application response. |
Use least privilege
Application scopes are independent and are not granted to existing keys automatically. A community must obtain the member's explicit consent before submitting a response on their behalf. See Applications through the API for the trusted-server flow and route reference.
Start with a read-only preset, test, then add one required write scope at a time. A scope only authorises the API surface; the community must also have the product feature and active subscription.
Use separate keys such as Production roster sync, Event service, and Staging tests. This makes audit activity attributable and lets you revoke one integration without interrupting the others.
Rotate a key
- Prepare the secret manager for a new value.
- Select Rotate on the intended key.
- Copy the new one-time secret into the server-side store.
- Deploy and test one safe read.
- Confirm the old secret no longer works.
Rotation invalidates the previous secret immediately. If cache invalidation cannot be reached, it can remain accepted for about one minute. Treat the old value as compromised and remove it everywhere.
Disable versus delete
Disable a key for a reversible pause. Delete it only when the integration is retired; deletion cannot be undone. The community API master switch disables all keys together.
A migrated legacy key is limited to the old /users and /v1 compatibility routes. Rotate it to obtain a current cl_live_ key before moving the integration to /v2.
For a step-by-step setup, see Create and manage API keys.