Create and manage API keys

What this doesCopy link to What this does

A Clan Labs API key lets a server-side integration call public API v2 routes for one community. Each key has its own name, enabled state, and permission scopes.

PrerequisitesCopy link to Prerequisites

• The community plan includes API access.
• You meet the community’s Settings requirement.
• A server-side secret manager is ready.
• You know the smallest scopes the integration needs.

Setup stepsCopy link to Setup steps

1. Open Settings → API Keys.
2. Turn on Enable the API for this community. This master switch controls every key.
3. Reveal and copy the Clan ID; it is used in X-Clan-Id and is not the secret.
4. Choose Create API Key.
5. Enter a descriptive name of up to 64 characters, such as Production integration.
6. Start with Read-only, or choose Member management, Full access, or a custom selection.
7. Create the key. A community can hold up to 25.
8. Copy the cl_live_… secret from the one-time modal and store it immediately.
9. Acknowledge that it cannot be shown again, then close the modal.
10. Test a read request before enabling write workflows.

Expected resultCopy link to Expected result

The key list shows the name, prefix, enabled state, creation date, and permission count. API v2 accepts it with Authorization: Bearer YOUR_API_KEY and X-Clan-Id: COMMUNITY_ID.

Verify that it worksCopy link to Verify that it works

Call GET /v2/members?limit=1 with a key that has members.read. Expect a 200 response containing data. Confirm the related audit record identifies the API key name, not the secret.

Common errorsCopy link to Common errors

• missing_credentials — one or both authentication headers are absent.
• invalid_api_key or another 401 — the key is malformed, unknown, or paired with the wrong Clan ID.
• key_disabled or api_disabled — enable the key and community master switch.
• insufficient_scope — add the exact required scope or use another key.
• legacy_key_unsupported — rotate a migrated V2 key to issue a current cl_live_ key.
• 403 feature or entitlement errors — the community plan, trial, or subscription state does not include the endpoint’s feature.

Security practicesCopy link to Security practices

• Store keys only in server-side environment variables or a secret manager.
• For Roblox server Script requests, store the key in the Creator Hub secrets store and read it with HttpService:GetSecret().
• Never embed a key in client JavaScript, a Roblox LocalScript, experience source code, source control, screenshots, or support messages.
• Use one key per integration and environment.
• Rotate immediately after suspected exposure. The old secret stops working immediately, or within about a minute if cache invalidation cannot be reached.
• Disable or delete unused keys; deletion cannot be undone.

Next, read API authentication and API keys and scopes.