Skip to main content

​
How to Create an API Key

Step-By-Step 02 · Start as a developer: API keys, sandbox and MCP

A key belongs to one environment: Sandbox or Production. A sandbox key works on your organization’s test data, which is kept temporarily, against the same API as a production key. Start in the sandbox, and create a production key when your integration works. See Test and Live Data.
1

Open Developer Tools

Go to app.rootkey.ai and sign in. If you belong to more than one organization, select the one the key is for. In the left sidebar, under Connect, click Developer Tools.If the organization has no keys yet, the page offers Create a sandbox key and Create a production key. Click the one you need.Developer Tools page with Create a sandbox key and Create a production key
2

Choose the environment

On the API Keys tab, the Production / Sandbox switch at the top shows the active environment. In the sandbox, the sidebar shows Sandbox under the organization name and Exit sandbox at the bottom. Click Actions in the top right corner, then Create API key.API Keys tab in the sandbox, with the Actions menu open
3

Fill in the key details

Enter a Key Name and an optional description. Under Environment, choose Sandbox or Production, and choose an icon to help identify this key. Click Generate Key when ready.Create your new API Key form with the Environment choice
4

Copy and store your key

Your new API key is displayed once. Copy it, or download it, and store it in a secure location - it will not be shown again after you click Done.API Key Created dialog, with the key value hidden
5

Confirm the key is active

The key appears in the API Keys list with an Active status and a request counter. Expand it to see its usage, environment and permissions. You are ready to authenticate API calls.API Keys list with the new key active and expanded

​
Using Your API Key

Pass the key in the x-api-key header on every request:
→ See Authentication for the full reference and error handling. An AI agent or a script that should act as a person, with only that person’s access, can use a personal access token instead of an API key.

​
Best Practices

API keys grant full access to your workspace. Keep them server-side and use environment variables - never commit them to source control or include them in frontend bundles.
Create a separate key for each application or environment. This makes it easy to rotate or revoke a single integration without affecting others.
Regenerate keys on a regular schedule and immediately on any suspected exposure. Old keys can be revoked from the Developer Tools panel without downtime if a replacement is in place.
The Developer Tools Overview tab shows request volume and error rates per key. Unusual spikes may indicate misuse or an integration issue.