Skip to main content
An API key lets software, or an AI assistant, read your Reclosed data. Whoever holds it can read everything the API and the MCP server offer for your account, including your leads’ names and contact details and your conversations, so keep it as safe as a password. Use it to call the API or to connect an AI assistant.

​
Create a key

1

Open API keys

In Reclosed, open API keys from the menu.
2

Generate it

Click Generate key and name it after where it will be used, such as “Acme production server” or “Claude, Sam’s laptop”, so you know what you’re revoking later. If your account uses an authenticator app, Reclosed may ask you for a fresh code first.
3

Copy it now

The key is shown once. Reclosed keeps only a fingerprint of it (a hash), so nobody, including Reclosed, can show it again. If you lose it, revoke it and generate another.
Keys don’t expire. A key reads only the account that created it. The Last used column shows when each key was last used.

​
Share it safely

  • Send it through a password manager or another secure channel, not plain email or chat.
  • Give each developer, system or AI assistant its own key, so you can revoke one without breaking the others.
  • When someone no longer needs access, such as a contractor whose work is done, revoke their key.

​
Revoke a key

On the API keys page, click Revoke next to the key and type its name to confirm. It takes effect immediately: anything still using the key stops working.

​
Send the key with each request

Put the key in the Authorization header of every request:
Call the API from your server. Keep the key in a secret manager or an environment variable, never in source control, and never in browser or mobile app code, where anyone using the app can read it. If there’s a problem with the key, the API answers 401 with "code": "unauthorized" and a WWW-Authenticate: Bearer header. The message depends on what’s wrong:
  • No key, or an Authorization header that doesn’t start with Bearer: the message is “Provide an API key as Authorization: Bearer rk_live_….”
  • An unknown, revoked or malformed key: the message is “That API key is not valid.” It’s the same for all three, so nobody can use the API to check whether a key they found was ever real.