API keys
Create scoped keys for programmatic access, authenticate your requests, and keep keys safe once they are issued.
API keys give programmatic access to your team's resources — most commonly to post orders from your backend. They belong to the team, not to a project, and carry their own scopes independent of your personal role.
Creating a key
Go to Team settings → API keys and choose Add API key. Only team owners can create, edit or delete keys; members can view the list.
Name
Name it for where it runs — Production backend, Staging, Reporting job.
When you need to revoke one in a hurry, the name is what tells you which is safe
to kill.
Permissions
Each resource gets a level: None, Read or Write. Write includes read.
Available resources:
| Resource | What it covers |
|---|---|
teams | Team details |
projects | Project details and settings |
dashboard | Dashboard data and presets |
adsManager | Campaigns, ad sets and ads |
orders | Orders — the one your checkout integration needs |
customers | Customer records |
products | Products |
analytics | Analytics data |
Three presets are available: All, Read only and Restricted — start from one and adjust.
A checkout integration that posts orders needs orders: Write and nothing else.
Grant exactly that. If the key leaks, the damage is bounded to the one thing it
was for.
Copy it immediately
The key is shown once, in the dialog right after creation. It is stored hashed, so nobody — including Clakta support — can retrieve it afterwards.
If you lose it, delete the key and create a new one.
Authenticating
Send the key as a bearer token:
curl https://api.clakta.com/v1/orders \
-H "Authorization: Bearer $CLAKTA_API_KEY"The Bearer prefix is required. Without it you get an explicit "Misconfigured
authorization header" error rather than a generic 401.
await fetch("https://api.clakta.com/v1/orders", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLAKTA_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify(payload),
})Keeping keys safe
Monitoring and revoking
The API keys list shows Last used for each key — the fastest way to find keys nobody needs any more.
Team settings → API logs records the requests made with your keys, which is where to look when an integration starts failing.
Deleting a key takes effect immediately and cannot be undone. Any integration using it starts failing on its next request, so update the consumer first when you are rotating rather than revoking.
Rate limits
Requests per minute depend on your plan: 60 on Free, 600 on Pro, 1,200 on Business. See Plans and limits.
Related
Related articles
Members and roles
Invite people to your team, understand what each of the four roles can do, and control which projects a member can see.
Plans and limits
What each plan includes, which limit you are most likely to hit first, and how to decide when to upgrade.
Usage and billing
Read the usage charts, understand when your allowance resets, and manage your plan, invoices and payment method.