Open Automations in the left sidebar and pick the API Keys tab. The page states its own job in one line: "Public API keys for programmatic access to your account. Each key is shown in full only once at creation; revoke and re-create to rotate." A key here is a server-to-server credential: your backend sends it in an HTTP header and gets JSON back. It is not the key that powers your embedded web chat — that is a different tab, a different prefix and a different set of rules, and the first section below is the whole difference.
Two kinds of key, and they are not interchangeable
IcloneU issues two credentials that both get called an API key. They live on different pages, protect different things, and each one is refused where the other belongs. Thirty seconds here saves an afternoon of 401s.
| Web chat key (hk-) | Public API key (ik-) | |
|---|---|---|
| Where you create it | Connections → API keys | Automations → API Keys |
| What it is for | One embeddable widget, answered by one Clone | Your own code reading and writing your account's data |
| Who holds it | The visitor's browser — it is visible in your page source | Your server, and nowhere else |
| What limits its reach | Which Clone answers, plus the Domains allowlist | One of three access levels, applied per endpoint |
| How it travels | Inside the embed snippet's URL | An Authorization: Bearer ik-… header |
| How you rotate it | Delete the key, create another, re-embed | Revoke the key, create another, redeploy |
| Can it expire on its own | No | Yes — you choose the term at creation |
The public API checks the prefix before it does anything else. A request whose header does not begin with Bearer ik- is refused with a 401 and the code missing_api_key, even when the widget key it carries is perfectly valid. It does not work the other way round either — an ik- key does nothing for the chat widget. The widget key has its own walkthrough: Creating and managing API keys.
Creating a key
Three fields, one button, and one moment you cannot repeat.
Open the tab
Automations in the left sidebar, then the API Keys tab. If you do not see it, your team role does not include Automations, or your plan does not — the tab is part of every paid plan.
Click Create Key
The button sits at the top right of the page and opens the Create API Key dialog.
Give it a Label
Label is the name you will see in the grid, and the placeholder shows the idea: "e.g., Make.com Production". Name it after the system that will hold it, because that is the question you will be answering when you decide whether to revoke it. Generate Key stays disabled until the Label has something in it.
Pick the Access Level
Access Level offers Read Only, Standard and Full Access, and the dialog opens on Standard. The next section says exactly what each one buys.
Heads upThere is no edit dialog for a key. The level you pick here is the level it has forever — changing it means creating a second key and retiring the first.
Pick the Expiration
Expiration offers Never expires, 30 days, 90 days and 1 year, counted from the moment you generate the key. A fresh dialog opens on Never expires; if you have already created a key without leaving the page, the dialog keeps whatever you picked last time, so glance at it before you click.
Heads upAn expiry is a dead man's switch, not a reminder. Past the date the API answers 401 key_expired and the grid pill flips to Expired — with no warning beforehand and no way to extend.
Click Generate Key and copy it
The key appears once, in a dialog that says so plainly: "Copy this key now. You won't be able to see it again." Use Copy Key, paste it straight into your secret store, then click Done.
IcloneU keeps a SHA-256 hash of the key plus its first eight characters — enough to recognise the key when it comes back and to show you a stub in the grid, and not enough to reconstruct it. Nobody can read it back to you: not the grid, not support, not a database query. If it is lost, the only route is revoke and create another.
What the three access levels actually gate
The level is checked per endpoint, not per resource, and the split is blunt on purpose: reads are open to every key, ordinary writes need Standard, and two areas need Full Access.
| Access Level | What a key at this level can do |
|---|---|
| Read Only | Every read. List and open assistants, workflows, contacts, conversations and their messages, custom fields, connected platforms, tags, reviews and webhook subscriptions. It cannot change anything at all. |
| Standard | Everything above, plus the ordinary writes: create and update a contact, add or remove a contact's tags, delete or erase a contact, create a tag, and post a message into a conversation. |
| Full Access | Everything above, plus the two privileged areas: changing a workflow's status, and every webhook-subscription write — create, update, delete, send test, rotate secret and redeliver. |
A call that needs more than the key carries is refused with a 403 and the code insufficient_permissions, and the message names what was missing: "This API key does not have full access. Required: Full Access tier." Nothing partial happens first — the check runs before the request is read.
Read Only, Standard and Full Access are the names in the dialog, in the grid badge, in the API's own refusal message and in this guide. They are not translated: a Spanish-language session shows the same three English names. Read them as identifiers rather than as labels.
What a key reaches
Everything hangs off /api/public on your own IcloneU address, and every route is scoped to the account the key was created in — an id belonging to somebody else's account comes back as a 404, not as data.
- Assistants (/assistants) — list your Clones, and read one.
- Automations (/automations) — list your workflows, read one, and (Full Access) change a workflow's status.
- Contacts (/contacts) — list, read, create, update, delete and erase a contact, and add or remove its tags.
- Conversations (/conversations) — list, read one, read its messages, and post a message into it.
- Custom fields (/custom-fields) — list the custom fields defined on your account.
- Platforms (/platforms) — list the platform accounts you have connected.
- Tags (/tags) — list and create.
- Reviews (/reviews) — the summary, the list, and the schema behind them.
- Webhooks (/webhooks) — the whole outbound-subscription surface, covered in Webhook subscriptions.
List endpoints take page and per_page. A page size above 100 is clamped to 100 rather than refused, and the response carries a meta block with page, per_page, total and total_pages so you can walk the whole set without guessing.
Browse it at /api/public/docs — a full request-by-request reference with a Download openapi.json link — or fetch the machine-readable spec directly from /api/public/openapi.json and point your own client generator at it. Both are open without a key. Prepend your IcloneU address to either path.
Calls are rate-limited to 60 per minute per key, in a fixed one-minute window with no queue: request 61 is answered 429 immediately rather than held. The budget belongs to the key, so splitting a noisy job onto its own key stops it from starving the rest of your integration.
Reading the grid
Five columns — Label, Key, Access, Last Used and Created — and the status lives inside the first one.
- Label carries a pill beside the name: Active, Expired once the expiration date has passed, or Revoked. The pill and the API agree — a key the grid calls Expired is a key the API is already refusing.
- Key shows the first eight characters and an ellipsis. That is the ik- prefix plus five characters — enough to tell two keys apart in a config file, and not enough to be a credential.
- Access is the level chosen at creation.
- Last Used is stamped on every request the key gets through with, so it is the honest answer to the only question that matters before you revoke: is anything still calling with this? A key that has never been used reads Never — in English, in both interface languages.
- Created is the date the key was generated. A revoked row is greyed out and stays in the list rather than disappearing.
The Expiration you choose is stored and enforced, but no screen shows it back to you. It is not a column in the grid, it is not on the one-time key dialog, and there is no edit dialog to reopen. Unless you record it yourself when you create the key, the first sign that a 90-day key has aged out is a 401 key_expired in your own logs. Put the date next to the key in whatever holds your secrets.
Rotating, revoking, and the errors you will see
There is no regenerate button and no reveal. Rotation is revoke and create another — and because revoking takes effect on the very next request, the order you do it in decides whether anything goes down.
Create the replacement first
Same Access Level, a Label that says which generation it is. Deploy it to whatever holds your secrets and let the traffic move over.
Confirm the old key has gone quiet
Watch Last Used on the old row. While it is still moving, something is still calling with it — revoking now is an outage, not a rotation.
Select the old key and click Revoke
The confirmation is specific about the blast radius: "Are you sure you want to revoke the key "{0}"? Any integrations using this key will stop working immediately." Confirm and it is done — there is no undo and no recycle bin.
Nothing warns you before an expiration date, and nothing lets you push it out. The fix for an expiring key is the same as the fix for a leaked one: create the replacement, move the traffic, then revoke. If you cannot commit to that routine, choose Never expires and rotate on your own schedule instead.
| What comes back | What it means |
|---|---|
| 401 missing_api_key | The Authorization header is absent, or does not start with Bearer ik-. A web-chat hk- key lands here. |
| 401 invalid_api_key | The key is not a well-formed ik- key, or no key with that fingerprint exists in any account — including a key that was deleted and recreated elsewhere. |
| 401 key_revoked | The key exists and was revoked. |
| 401 key_expired | The key is past the Expiration chosen when it was created. |
| 403 insufficient_permissions | The key is real but its Access Level is below what this endpoint needs. |
| 404 not_found | No such id in this account. Same answer whether the record never existed or belongs to somebody else. |
| 429 | More than 60 requests from this key inside the same minute. |
| 500 internal_error | The call reached IcloneU and failed inside it. Safe to retry. |
Frequently asked
No. A key has no edit dialog — the only row action is Revoke. Both choices are made once, at creation. Changing either one means creating a new key and retiring the old one.
No. A public API key is account-wide by design; the Clone binding belongs to the web-chat key model. What you can vary is the access level, so a read-only reporting job and a write-capable sync job should hold different keys.
The tab records one thing: Last Used, refreshed on every request the key gets through with. There is no per-key request log in the product, so treat Last Used as a liveness signal — useful for deciding whether a key is safe to revoke, not as an audit trail.
No. The row stays in the grid, greyed out, but the key itself is finished — every request with it answers 401 key_revoked. Create a replacement and deploy it.
No. /api/public/docs and /api/public/openapi.json are deliberately left open, so you can read the reference and generate a client before you ever create a key. Every actual data endpoint under /api/public needs one.
Last updated August 25, 2026 · Automations
