On this page
Authentication#
Every API request must include a valid API key. Keys are scoped to control what resources they can access and can be rotated or revoked at any time.
Creating an API Key#
- Go to Console → Settings → Developer
- Click "Create API Key"
- Give your key a name and select the scopes it needs
- Optionally set an expiration (30 days, 90 days, or 1 year)
- Copy the key — it starts with
api_and is shown only once
Using Your API Key#
Include the key in the X-API-Key header of every request:
curl https://api.infinichat.dev/knowledge-bases/{kbId}/products \
-H "X-API-Key: api_your_api_key"Scopes#
Each API key has one or more scopes that control which operations it can perform. Assign the minimum scopes needed — for example, a read-only sync job should only use products:read. Scopes can be updated anytime from the Developer tab.
| Scope | Description |
|---|---|
products:read | List and retrieve products |
products:write | Create, update, and delete products |
faqs:read | List and retrieve FAQs |
faqs:write | Create, update, and delete FAQs |
locations:read | List and retrieve locations |
locations:write | Create, update, and delete locations |
conversations:chat | Create sessions, send messages, and manage conversations |
When you enable the conversations:chat scope, you can also pick a Response Content Format on the API key — Markdown, Plain text, Facebook Messenger, Instagram Messaging, or WhatsApp Business. The chosen format applies to both sync and callback responses for that key. See Response Formats for the per-channel envelope reference and middleware code samples.
Security Best Practices#
- Never commit API keys to source control. Use environment variables or a secrets manager.
- Use the least scopes needed. A sync job that only reads products should use
products:readonly. - Set an expiry. Rotate keys periodically or use the built-in TTL options (30 days, 90 days, 1 year).
- Revoke compromised keys immediately. Revocation takes effect within 5 minutes (authorizer cache TTL).
- Monitor usage. Check the Usage History page in the Console to see what each key is doing.
Revoking a key#
Revocation takes effect immediately on every endpoint that writes data or runs a metered operation. Read-only endpoints may keep accepting a revoked key for up to five minutes: authorisation results are cached at the gateway, and re-validating every read would add a round trip to calls that cannot change anything. If you need a key dead everywhere instantly, revoke it and treat the read window as expected.