# Connect your own tools with an API key


> Create an organization API key and call the CopyHero API from your own dashboards, scripts, or AI-built tools.


Canonical URL: https://www.copyhero.app/help/integrations/api-keys

An API key lets your own code read and change your organization's CopyHero data through the CopyHero API, for example to build a dashboard.

## Prerequisites [#prerequisites]

You are a member of the organization the key is for. A key acts with **your** role in that organization, so it can do what you can do there, no more.

## Steps [#steps]

1. Open the user menu at the bottom of the sidebar.
2. Under **Settings**, select **API keys**.
3. Select **New API key**, enter a name, and optionally a description and an expiry.
4. Copy the key. It starts with `ak_` and is shown only once.

<!-- screenshot: integrations-api-keys -->

## Use the key [#use-the-key]

Send the key as a bearer token:

```bash
curl https://app.copyhero.app/api/v1/users/me \
  -H "Authorization: Bearer ak_..."
```

The API reference lists every operation a key may call:

`https://app.copyhero.app/api/v1/api-keys/openapi.json`

Any operation not in that reference answers `401` to an API key.

## Keep the key secret [#keep-the-key-secret]

Anyone who has the key acts as you in your organization.

* Call the API from a server, a script, or a tool that keeps the key on a server, never from code that runs in a browser. A web page that contains the key gives it to every visitor.
* Do not commit the key to a repository or paste it into chats, tickets, or public URLs. Store it in an environment variable or a secret manager.
* Use one key per tool, so you can revoke one without breaking the others.

## Build a tool with an AI assistant [#build-a-tool-with-an-ai-assistant]

When you ask an AI assistant such as Claude to build a dashboard or script for you, give it this page and the API reference above. Tell it:

* Read `https://app.copyhero.app/help/integrations/api-keys.md` and the operations in `https://app.copyhero.app/api/v1/api-keys/openapi.json`.
* Send the key as `Authorization: Bearer <key>` and read it from an environment variable, never hard-code it.
* Call the CopyHero API from server-side code only. Browser code that calls the API directly does not work and would expose the key.

## Expected result [#expected-result]

To revoke a key, select it in the list and select **Revoke**. Requests with the key answer with your organization's data. A key you revoke stops working within a minute, and so does a key whose creator leaves the organization.

## If something goes wrong [#if-something-goes-wrong]

* `401`: the key is wrong, revoked, or expired, or the operation does not accept API keys. Check the API reference.
* `403`: the key's creator has no CopyHero account, CopyHero does not know the key's organization, or the creator's role lacks the permission the operation needs (for example, viewing analytics). Give the creator that permission, or use a key created by a member who has it.
* `503`: CopyHero could not verify the key right now. Retry later.

## Related guides [#related-guides]

* [Configure outbound webhooks](/help/integrations/outbound-webhooks)