Overview

Manage API keys that authenticate REST API requests to your CometChat app.

API Keys are credentials used to authenticate REST API requests. Every request to the CometChat REST API must include a valid API key in the apikey header. CometChat supports two types of API keys with different access levels.

Available operations

Method	Endpoint	Description
POST	/apikeys	Create a new API key
GET	/apikeys	List all API keys
GET	/apikeys/{apiKey}	Get a specific API key
PUT	/apikeys/{apiKey}	Update an API key
DELETE	/apikeys/{apiKey}	Delete an API key

Key types

• Full Access — Can perform all operations including creating/deleting users, managing groups, and sending messages. Use this for server-side integrations only.
• Auth Only — Can create users and generate auth tokens. Suitable for quick demos and prototyping, but not recommended for production (see warning below).

Never expose a Full Access API key in client-side code. Keep Full Access keys on your server only.

The Auth Only key (authOnly scope) is intended for quick demos and prototyping only — it should not be used in production. In a production environment, auth tokens should be generated from your backend server during your application’s own authentication flow, and then passed to the client. This ensures that no API key is exposed on the client side.

API key properties

Property	Type	Description
apiKey	string	The unique API key string used in the apikey header for authentication.
name	string	A human-readable label for the key (e.g., “Production Server”, “Mobile Auth”).
scope	string	Access level: fullAccess or authOnly.
createdAt	integer	UNIX timestamp of when the key was created.

Error handling

Error Code	Description
ERR_APIKEY_NOT_FOUND	The specified API key does not exist
AUTH_ERR_NO_ACCESS	The API key doesn’t have the required scope

For the complete list of error codes, see Error Guide.