Shown once. Revoked immediately.

Sandbox keys are shown exactly once, expire after 180 days and are stored only as a SHA-256 derivative. A key never inherits more rights than the project and membership allow together.

Create a key Quickstart

Secret lifecycle

A secret is not an account password.

It belongs only in server-side secret management. Browsers, mobile apps, Git repositories, support messages and URLs are not secure storage locations.

Format: clt_test_…
Disclosure: The complete secret is shown exactly once after it is created.
Storage: Clarity stores the hash, prefix, last characters, scopes and lifecycle — not the readable key.
Quota: 120 requests per minute and key; Remaining and Reset are returned in response headers.
Rotation: Issue a new key, move the server over, then revoke the old key.
Revocation: Effective immediately on the server; old requests end with 401.

server.env

CLARITY_API_KEY=clt_test_…
# never expose with NEXT_PUBLIC_
# never commit this file