Developer API
API keys, scopes, rate limits, and programmatic access.
The Developer API lets you integrate Chatloop with your own backend, CRM, or internal tools using REST and bearer authentication.
Who can use it
Access requires all of the following:
- You are not a global team-member account (
TEAMrole)—invited team members cannot create or manage keys. - Your membership plan includes API access (
apiEnabled). - The platform administrator has not disabled the API globally.
When access is granted, the Developer API link appears in the sidebar footer (above your profile). If any requirement fails, the link is hidden and visiting /dashboard/settings/api redirects to the dashboard.
This is an account-level page—not tied to the active chatbot in the switcher—though you can scope individual keys to one chatbot.
Creating an API key
- Open Developer API from the sidebar footer.
- Enter a name (for your reference).
- Choose Live or Test environment.
- Optionally restrict the key to a single chatbot or leave it workspace-wide (All agents).
- Select scopes (see below).
- Click Create key and copy the secret immediately. It is shown only once.
Live secrets start with cl_live_; test secrets start with cl_test_. Store secrets securely. Revoke keys you no longer need from the same page.
Authentication
Send the secret as a Bearer token on every request:
Authorization: Bearer cl_live_your_secret_here
Base URL:
https://api.chatloop.io/v1
The same host and path structure is used for test keys. A machine-readable manifest is available at GET /api/v1/docs on your app host (also listed in the Developer API page header).
Scopes
Grant only the scopes your integration needs. All scopes can be selected when creating a key:
| Scope | Allows |
|---|---|
agents:read | List and read chatbots |
agents:write | Update chatbots (no v1 route yet) |
conversations:read | List conversations |
conversations:write | Create conversations |
messages:read | Read message history |
messages:write | Send messages |
customers:read | Read customer records |
customers:write | Update customers (no v1 route yet) |
knowledge:read | Read documents, FAQs, websites (no v1 route yet) |
knowledge:write | Manage knowledge (no v1 route yet) |
analytics:read | Usage and analytics (no v1 route yet) |
ai:invoke | Request AI responses (POST .../ai/respond) |
connectors:read | Connector catalog and agent connections |
connectors:write | Connect, disconnect, sync, and index knowledge |
Scopes marked no v1 route yet are reserved for future endpoints; selecting them has no effect until those routes ship.
Implemented v1 endpoints
| Method | Path | Scope |
|---|---|---|
| GET | /v1/agents | agents:read |
| GET | /v1/agents/{agentId} | agents:read |
| GET | /v1/agents/{agentId}/conversations | conversations:read |
| POST | /v1/agents/{agentId}/conversations | conversations:write |
| GET | /v1/agents/{agentId}/conversations/{conversationId}/messages | messages:read |
| POST | /v1/agents/{agentId}/conversations/{conversationId}/messages | messages:write |
| POST | /v1/agents/{agentId}/ai/respond | ai:invoke |
| GET | /v1/agents/{agentId}/customers | customers:read |
| GET | /v1/connectors/catalog | connectors:read |
| GET | /v1/agents/{agentId}/connectors | connectors:read |
| POST | /v1/agents/{agentId}/connectors/connect | connectors:write |
| DELETE | /v1/agents/{agentId}/connectors/connections/{connectionId} | connectors:write |
| POST | /v1/agents/{agentId}/connectors/connections/{connectionId}/sync | connectors:write |
| POST | /v1/agents/{agentId}/connectors/connections/{connectionId}/index-knowledge | connectors:write |
Connector endpoints require connectors:read or connectors:write. See Connectors.
Limits and quotas
Your plan may cap:
- Whether API access is enabled at all
- Requests per minute (burst protection, per key and per IP)
- Requests per month
- Maximum number of keys
The Developer API page shows API requests this month when available. If a request is rejected for quota or rate limiting, retry with backoff or upgrade your plan.
Platform administrators can disable the API globally or adjust default limits in the admin panel.
Related features
- Connectors — CRM/CMS integrations for in-chat and API-managed connections.
- Data Sources — live database or external API lookups configured per chatbot under Automation > Data Sources.
- Social integrations — Meta and Telegram are configured under Automation > Integrations, not via Developer API keys.
For internal admin ↔ app communication (super-admin operations), a separate service API key is used—that is not the same as owner Developer API keys.