API Keys & Domain Security
API keys authenticate your client websites, mobile apps, and backend services. Every key is encrypted with SHA-256 and protected with origin whitelisting.
Generating API Keys
Go to Dashboard > API Keys tab. Click 'Generate New API Key'. Enter a friendly label (e.g. 'Production Website Widget') and specify allowed origins.
CORS Domain Whitelisting
When embedding chat widgets on public websites, set allowed origins (e.g. https://mycompany.com). If an unauthorized domain tries to use your API key, our server automatically blocks the request with a 403 Forbidden response.
SHA-256 Storage Security
Raw API keys (tw_rag_live_...) are shown only once upon creation. Our database only stores the SHA-256 cryptographic hash. Even if our database were compromised, your raw keys cannot be extracted.
Revoking Keys
You can instantly deactivate or revoke any key from the API Keys table with 1 click. Revoked keys stop working immediately across all endpoints.