Developer Tools let a workspace owner create and manage credentials for trusted server-to-server integrations and embedded Chazt widgets.
Who can manage API keys
Only an active workspace owner can create, list, rotate, or revoke organization API keys. Team members and API keys cannot manage other API keys.
Create an organization API key
- Open Developer Tools in Chazt.
- Select Generate API key.
- Enter a clear name for the integration.
- Select only the scopes the integration needs.
- Choose an expiry date.
- Create the key and copy it immediately.
The complete key is displayed only once. Chazt stores only a protected one-way representation and cannot reveal the secret later. If the key is lost, rotate or revoke it and update the integration with the replacement.
Keep organization API keys on a trusted server. Never place them in browser code, mobile applications, screenshots, tickets, chat messages, or source control.
Available communication scopes
| Scope | Allows |
|---|---|
communications:capabilities:read | Check which communication channels are ready for this workspace. |
communications:write | Submit and cancel communication operations. |
communications:read | Read the safe status of submitted operations. |
communication-webhooks:manage | Register, view, and remove the integration's status webhook. |
Choose the smallest set of scopes required. For example, a connection-readiness check needs only communications:capabilities:read.
Rotate or revoke a key
Rotate a key when you need a replacement without changing the integration identity. The old key is revoked immediately, and the new secret is shown once. Existing operation history and the integration's webhook remain associated with the same integration identity.
Revoke a key when the integration is retired, compromised, or no longer required. Revoked and expired keys cannot access the API.
Use the Communication API
The Communication API supports scoped message, notification, call, status, cancellation, and signed-webhook workflows. See Communication API for authentication, request examples, delivery states, and channel limitations.
Embedded widget tokens
Widget tokens are separate from organization API keys. Software vendors can use them to embed Chazt inside their own platforms. A widget token's approved domains and widget permissions do not grant server-to-server communication access.
See Embedded Widget for Software Vendors for setup instructions and examples.