Connect your own tools with an API key

An API key lets your own code read and change your organization's CopyHero data through the CopyHero API, for example to build a dashboard.

PrerequisitesCopy Anchor Link

You are a member of the organization the key is for. A key acts with your role in that organization, so it can do what you can do there, no more.

StepsCopy Anchor Link

1. Open the user menu at the bottom of the sidebar.
2. Under Settings, select API keys.
3. Select New API key, enter a name, and optionally a description and an expiry.
4. Copy the key. It starts with ak_ and is shown only once.

Use the keyCopy Anchor Link

Send the key as a bearer token:

curl https://app.copyhero.app/api/v1/users/me \
  -H "Authorization: Bearer ak_..."

The API reference lists every operation a key may call:

https://app.copyhero.app/api/v1/api-keys/openapi.json

Any operation not in that reference answers 401 to an API key.

Keep the key secretCopy Anchor Link

Anyone who has the key acts as you in your organization.

• Call the API from a server, a script, or a tool that keeps the key on a server, never from code that runs in a browser. A web page that contains the key gives it to every visitor.
• Do not commit the key to a repository or paste it into chats, tickets, or public URLs. Store it in an environment variable or a secret manager.
• Use one key per tool, so you can revoke one without breaking the others.

Build a tool with an AI assistantCopy Anchor Link

When you ask an AI assistant such as Claude to build a dashboard or script for you, give it this page and the API reference above. Tell it:

• Read https://app.copyhero.app/help/integrations/api-keys.md and the operations in https://app.copyhero.app/api/v1/api-keys/openapi.json.
• Send the key as Authorization: Bearer <key> and read it from an environment variable, never hard-code it.
• Call the CopyHero API from server-side code only. Browser code that calls the API directly does not work and would expose the key.

Expected resultCopy Anchor Link

To revoke a key, select it in the list and select Revoke. Requests with the key answer with your organization's data. A key you revoke stops working within a minute, and so does a key whose creator leaves the organization.

If something goes wrongCopy Anchor Link

• 401: the key is wrong, revoked, or expired, or the operation does not accept API keys. Check the API reference.
• 403: the key's creator has no CopyHero account, CopyHero does not know the key's organization, or the creator's role lacks the permission the operation needs (for example, viewing analytics). Give the creator that permission, or use a key created by a member who has it.
• 503: CopyHero could not verify the key right now. Retry later.

Related guidesCopy Anchor Link

• Configure outbound webhooks