Despite the name, you won't find API keys under Account settings — they live on the Web chat page, where each key is one embeddable chat configuration answered by one of your AI Clones. This guide covers the full key lifecycle: creating a key, saving the secret that's shown exactly once, editing its settings, testing it, and rotating or revoking it when you need to.
A key needs a Clone to answer through it — the page itself tells you so: "You need to create at least one clone before you can generate API keys. Go to the Clones section to set up your first clone." Starting from zero? Begin with Creating your first AI Clone.
What an API key is in IcloneU
Open Web chat in the left sidebar (under Connections) and you'll find a grid of API keys. The page subtitle says it best: "Manage the API keys that power your embeddable widgets — Web Chat, Reviews, and more to come. Each key in the grid represents one widget configuration; use the toolbar to create keys, edit settings, test in the playground, or generate embed code."
Each row is one key, and each key delegates to exactly one Clone — the Clone supplies the personality, knowledge and skills that answer in that widget. The grid shows four columns: Name, Clone, Secret key (always masked, e.g. hk-ay…V508) and Created. Conversations that come in through the widget land in Messages, like every other channel's.
A key has no separate permission or scope settings. Its reach is defined by two controls: which Clone answers, and the optional Domains allowlist that limits where the key may run. That's the key's entire permission surface.
Create an API key
Creation takes under a minute. The only part you can't redo is saving the secret — so don't rush past the last step.
Open the Web chat page
Click Web chat in the left sidebar, under Connections. A new account shows an empty grid until you create your first key.
Start a new key
Click Create new API key in the toolbar. The Create new API key dialog opens.
Fill in the configuration
Name is the label you'll see in the grid — pick something that says where the key will be used. Clone is the AI Clone that will answer through this key (it defaults to your first Clone). Domains is an optional list of valid domains where the widget may run — the allowlist that limits where the key works. Language sets the default reply language.
TipThe optional Customize chat appearance button opens a Chat Customization window — pictures, colors, appearance options and display texts, with a live preview — so the widget matches your site before it ever goes live.
Click Create API key
The key is created immediately and a Save your key dialog appears.
Save the secret — you'll only see it once
The dialog shows the full secret (it starts with hk-) next to a Copy button, with the message: "Please save this secret key somewhere safe and accesible. You can use this key to integrate with IcloneU through the API." Store it in your password manager now — after you click Close, the grid only ever shows the key masked.
Heads upThere is no way to reveal the full secret later. If you lose it, the fix is to delete the key and create a new one — the walkthrough is in Rotate or revoke a key.
Manage keys from the toolbar
Select a key's row and the toolbar acts on it. Five actions cover the whole lifecycle:
| Action | What it does |
|---|---|
| Create new API key | Opens the creation dialog — the flow above |
| Settings | Opens the Edit API key dialog: the same fields as creation (Name, Clone, Domains, Language, Customize chat appearance) plus a Save button |
| Playground | Opens a chat sandbox to test the selected key's Clone before going live |
| Embed chat | Generates the script snippet that puts the widget on your site |
| Remove | Permanently deletes the key after a confirmation dialog — there's no undo |
The standing warning above the grid is worth taking literally: "Keep your API key secret. If it becomes public, it may be automatically disabled for your protection."
The Playground runs the key's Clone through the same metered pipeline as live conversations, so every test reply spends units from your plan balance — in live measurement a short reply came to ~7 units, though the exact cost varies with reply length and retrieved knowledge. Test deliberately, and see Understanding usage and limits for how units work.
Embedding has its own walkthrough — the snippet, the optional visitor-identity block and the "Widget not appearing? Check these common issues:" expander are covered in Embed guides.
Rotate or revoke a key
There's no reveal and no regenerate button for an existing key — rotation in IcloneU is delete + recreate. The same Remove action doubles as your revoke switch: the moment a key is deleted, anything still using it stops working.
Select the key and click Remove
On the Web chat page, select the key's row and click Remove in the toolbar.
Confirm the deletion
A dialog asks "Are you sure you want to delete this API key?" and spells out the consequences: "Once you delete this key, any chats or services using it will stop working. This action cannot be undone." Click Delete to confirm — keys have no recycle bin.
Create the replacement
Run the creation flow again — same Clone, same Domains — and copy the new secret from the Save your key dialog this time.
Re-embed wherever the key was used
Generate a fresh snippet with Embed chat and replace the old one on your site. The old key is dead, so the widget won't work again until the new snippet is in place.
Four habits keep rotation a rare event:
- Use the Domains allowlist. Set it at creation, or later via Settings — it limits where the key works even if someone copies it.
- Expect the key to be visible in your page source. It's a browser-side credential that travels in the snippet's embed.js?key=… URL — that's expected for a web widget, and the Domains allowlist is the control that matters.
- One key per site or purpose. Separate keys let you revoke one site without taking down the others.
- If a key stops working unexpectedly, it may have been automatically disabled for appearing public. Check the grid — if the key is gone or dead, create a new one and re-embed.
Frequently asked
No. The full secret is shown exactly once, in the Save your key dialog at creation; from then on the grid shows it masked (e.g. hk-ay…V508) and there's no reveal option. Delete the key, create a new one, and copy the secret this time.
Yes. Select the key and click Settings — the Edit API key dialog has the same fields as creation, so you can re-point the key at a different Clone, adjust Domains or Language, and click Save without touching the snippet already on your site.
In the Messages surface, like every other channel's conversations — answered by the Clone bound to that key.
Yes — Playground test replies consume units like live replies do. A short reply measured ~7 units in live testing, but the cost is token-based and varies with reply size. Understanding usage and limits has the full picture.
Last updated July 27, 2026 · Account & Settings
