API Keys
Create keys to use the Klipeo API, choose read-only or full access, and keep an eye on usage.
API keys let you talk to the Klipeo API from your own scripts and tools. You create and manage them in Settings → API keys.
Creating a key
Give the key a name you'll recognize later, like "local dev" or "publish bot".
Decide whether it should be read-only. Leave it off for a key that can also create and change things.
Copy it now
The full token is shown once, at creation, and it hides itself again after about 45 seconds. Klipeo stores only a hash, so it can't show it to you again. If you lose it, revoke the key and make a new one.
Tokens look like klipeo_sk_…. You send them as a bearer token, which the
API overview covers.
Scopes
A key carries scopes that decide what it can do:
| Scope | Allows |
|---|---|
read | Reading your projects, compositions, and account |
write | Creating and changing things, like uploads |
A normal key gets both. A read-only key gets just read, and write requests with it
are rejected. Use read-only keys for anything that only needs to look.
The generation endpoints (/api/v1/generate/*) specifically need write. A
read-only key calling one gets a 403 saying the key lacks the write scope.
Managing keys
The keys page lists each key with its scopes (read · write or read-only), a short
display prefix so you can tell keys apart, and when it was last used. There is no
creation date in the list.
Keys do not expire. Creating one takes a name and scopes, and nothing else, so
revoking is the only way to retire a key. Revoke is two steps: click Revoke, then
Confirm. It is permanent, takes effect immediately, and afterwards requests with that
key come back as 401 Invalid or revoked API key. Rotate a key by creating a new one
and revoking the old one.
There's also a usage chart showing your API calls per day over the last 14 days, so you can see what's calling and how much.
Phone pairing uses a key too
The
capture-from-phone
feature creates a short-lived pairing token (klipeo_pt_…) behind the scenes.
It can only do uploads, it expires in about ten minutes on its own, and it
never appears in this list, so there is nothing here to revoke.