Manage API access and private keys
Give an authorized integration only the access it needs through the existing API Tokens controls.
Explore this guide
Choose the access deliberately
Open Profile Settings → API Tokens when you need supported API access for an integration. Review the available scopes and create the smallest appropriate grant for its purpose. This is an advanced setup option; ordinary Character chat does not require copying an API key into a prompt.
Read the full sectionChoose the access deliberately
Open Profile Settings → API Tokens when you need supported API access for an integration. Review the available scopes and create the smallest appropriate grant for its purpose. This is an advanced setup option; ordinary Character chat does not require copying an API key into a prompt.
Keep the key private
Store the issued key in the integration’s secure secret settings. Do not put it in a public Page, shared screenshot, source repository or Slack conversation. Treat a key as access, not as harmless configuration text.
Review or remove unused access
Use the existing token controls to inspect and revoke access you no longer need. Confirm the integration and owner before changing a live connection. Request help if you are unsure which work depends on a key.