This article shows you how to create a scoped API key for an integration, and how to keep it safe. API access and webhooks are included from the Growth plan. Only account administrators can create, change or revoke keys.
hc_, acts as the account, and carries only the scopes you grant, plus its own rate limit, an optional IP allowlist and an optional expiry date.Both are sent in the same header: Authorization: Bearer <token>.
contacts:read, conversations:read and messages:read.Screenshot: The new API key form with scopes selected and the one-time key shown.
If you prefer to script it, the same key can be created with POST /api/v2/accounts/{account_id}/api-keys using your personal token. The full request and the complete scope table are in the Developer Hub at https://developers.huechat.ai.
Scopes come in read and write pairs for conversations, messages, contacts, inboxes, teams, AI Agents, Broadcasts, webhooks, labels and automations, plus reports:read and account:read. The picker lists every scope your account can grant, including newer ones for templates, workflows, Tickets, deals and Appointments. A key that lacks a scope receives a 403 with the message "API key scope is not authorized for this route".
From the same API keys page (or the matching API calls) you can:
Every create, change, rotate and revoke is written to the API key audit log.
Store keys in an environment variable or a secrets manager, never in browser code or a public repository. Use one key per integration so you can revoke exactly one thing when a partner is retired. If a key leaks, rotate or revoke it at once. Keys are stored only as hashes, so HueChat cannot show you a lost key.