API keys
Sandbox availableShown once. Revoked immediately.
Sandbox keys are shown exactly once, expire after 180 days and are stored only as a SHA-256 derivative. A key never inherits more rights than the project and membership allow together.
Secret lifecycle
A secret is not an account password.
It belongs only in server-side secret management. Browsers, mobile apps, Git repositories, support messages and URLs are not secure storage locations.
- Format
clt_test_…- Disclosure
- The complete secret is shown exactly once after it is created.
- Storage
- Clarity stores the hash, prefix, last characters, scopes and lifecycle — not the readable key.
- Quota
- 120 requests per minute and key; Remaining and Reset are returned in response headers.
- Rotation
- Issue a new key, move the server over, then revoke the old key.
- Revocation
- Effective immediately on the server; old requests end with 401.
CLARITY_API_KEY=clt_test_…
# never expose with NEXT_PUBLIC_
# never commit this file