Generate and Use API Keys

API keys let your code authenticate with the Coop API without using a user session. They're the right choice for server-to-server integrations, scripts, and CI pipelines.

Create a key

1. Go to Settings > API Keys
2. Click Create Key
3. Enter a name (e.g. "Production server", "Zapier integration")
4. Optionally set an expiration date
5. Click Create
6. Copy the key immediately — it's only shown once

Keys are prefixed with brk_live_ (production) or brk_test_ (test mode). The dashboard shows a hint (last 4 characters) so you can identify keys later.

Use the key

Pass the key in the Authorization header on every request:

curl https://api.coop.example.com/api/v1/messages \
  -H "Authorization: Bearer brk_live_xxxxxxxxxxxx"

API keys work with all API endpoints and have the same permissions as the user who created them.

Revoke a key

If a key is compromised or no longer needed:

1. Go to Settings > API Keys
2. Find the key by its name or hint
3. Click Revoke

Revoked keys stop working immediately. Any requests using them will return 401.

Best practices

• Give each integration its own key so you can revoke them independently
• Set expiration dates for keys that are only needed temporarily
• Don't embed keys in client-side code — they should only be used from your server