Create and manage API keys

A Clan Labs API key lets a server-side integration call public API v2 routes for one community. Each key has its own name, enabled state, and permission scopes.

The Clan Labs API key is separate from Roblox Creator OAuth. Integrations use the key; a community owner authorizes Roblox-backed operations through Settings → Roblox Cloud. Creating or rotating this key does not reconnect Roblox.

Before you startCopy link to Before you start

• The community plan includes API access.
• You are an Owner or the Discord server owner.
• A server-side secret manager is ready.
• You know the smallest scopes the integration needs.

StepsCopy link to Steps

1. Open Settings → API Keys.
2. Turn on Enable the API for this community. This master switch controls every key.
3. Reveal and copy the Clan ID; it is used in X-Clan-Id and is not the secret.
4. Choose Create API Key.
5. Enter a descriptive name of up to 64 characters, such as Production integration.
6. Start with Read-only, or choose Member management, Full access, or a custom selection.
7. Create the key. A community can hold up to 25.
8. Copy the cl_live_… secret from the one-time modal and store it immediately.
9. Acknowledge that it cannot be shown again, then close the modal.
10. Test a read request before enabling write workflows.

Check the resultCopy link to Check the result

The key list shows the name, prefix, enabled state, creation date, and permission count. API v2 accepts it with Authorization: Bearer YOUR_API_KEY and X-Clan-Id: COMMUNITY_ID.

Call GET /v2/members?limit=1 with a key that has members.read. Expect a 200 response containing data. Confirm the related audit record identifies the API key name, not the secret.

• Store keys only in server-side environment variables or a secret manager.
• For Roblox server Script requests, store the key in the Creator Hub secrets store and read it with HttpService:GetSecret().
• Never embed a key in client JavaScript, a Roblox LocalScript, experience source code, source control, screenshots, or support messages.
• Use one key per integration and environment.
• Rotate immediately after suspected exposure. The old secret stops working immediately, or within about a minute if cache invalidation cannot be reached.
• Disable or delete unused keys; deletion cannot be undone.

Common errorsCopy link to Common errors

• missing_credentials — one or both authentication headers are absent.
• unauthorized — the key is malformed, unknown, or paired with the wrong Clan ID.
• key_disabled or api_disabled — enable the key and community master switch.
• insufficient_scope — add the exact required scope or use another key.
• legacy_key_unsupported — rotate a migrated V2 key to issue a current cl_live_ key.
• 403 feature or entitlement errors — the community plan, trial, or subscription state does not include the endpoint’s feature.

Next, read API authentication and API keys and scopes.