GitLaw How-To guides

Create, copy and revoke GitLaw API keys

GitLaw API keys authenticate requests to the GitLaw Public API. If you want to trigger contract generation or document analysis from your own tools - or from automation platforms like Make, n8n, or Pipedream - you'll need an API key.

GitLaw provides a management interface to create, copy, and revoke keys.

What API keys are for

An API key is a secret credential that identifies your account when you call the GitLaw Public API. Every API request includes the key (via the X-API-Key header), and GitLaw uses it to authenticate and authorise the request. Anyone holding the key can make requests as you, so treat it like a password.

Create a key

Open your GitLaw account settings and go to the API keys section.
Choose to create a new key.
GitLaw generates the key and displays it.

Copy the key (shown only once)

When a key is created, GitLaw shows the full secret only once, at creation time. Use the copy action to copy it immediately and store it somewhere secure - a secrets manager or your integration's environment configuration.

If you navigate away without copying it, you won't be able to see the full key again. In that case, create a new key and revoke the old one.

Revoke a key

If a key is no longer needed, has been exposed, or you want to rotate credentials, revoke it from the same API keys section. Once revoked, the key stops working immediately and any system still using it will receive a 401 Unauthorized response. To keep an integration running, create a new key first and update your integration before revoking the old one.

Security best practice

Store keys securely - never commit them to source control or paste them into shared documents or chats.
Treat a key like a password - anyone with it can act as you against the API.
Rotate regularly - periodically create a new key and revoke the old one.
Revoke on exposure - if a key may have leaked, revoke it straight away and issue a replacement.
Use one key per integration where practical, so you can revoke a single integration without affecting others.

For the full list of endpoints, request and response formats, and example requests, see the GitLaw Public API Reference. If you'd rather not write code, the Zapier integration offers a no-code alternative.

Quick reference

Question	Answer
What is an API key for?	Authenticating requests to the GitLaw Public API.
When can I copy the full key?	Only once, at creation - copy and store it then.
What if I lose it?	Create a new key and revoke the old one.
What does revoking do?	Disables the key immediately; requests using it return `401`.
How should I store it?	Securely, like a password - never in source control or shared chats.