GitLaw How-To guides

Create, copy and delete GitLaw API keys

To create a GitLaw API key, open your account settings, go to the API keys section and choose to create a new key. Copy the key immediately: the full secret is shown only once, at creation. To delete a key, use the same section; deletion is permanent, and deleted keys stop working immediately and return a 401 Unauthorized response.

Before you start: a GitLaw account.

How do I create a GitLaw API key?

GitLaw API keys authenticate requests to the GitLaw Public API. If you want to trigger contract generation or document analysis from your own tools, or from automation platforms like Make, n8n or Pipedream, you will need an API key.

Open your GitLaw account settings and go to the API keys section.
Choose to create a new key.
GitLaw generates the key and displays it.

An API key is a secret credential that identifies your account when you call the GitLaw Public API. Every API request includes the key via the X-API-Key header, and GitLaw uses it to authenticate and authorise the request. Anyone holding the key can make requests as you, so treat it like a password.

How do I copy an API key?

When a key is created, GitLaw shows the full secret only once, at creation time. Use the copy action to copy it immediately and store it somewhere secure, such as a secrets manager or your integration's environment configuration.

If you navigate away without copying it, you will not be able to see the full key again. In that case, create a new key and delete the old one.

How do I delete an API key?

If a key is no longer needed, has been exposed, or you want to rotate credentials, delete it from the same API keys section. Deletion is permanent and cannot be undone. Once deleted, the key stops working immediately and any system still using it receives a 401 Unauthorized response. To keep an integration running, create a new key and update your integration before deleting the old one.

Limits: up to 30 keys per account; key names up to 50 characters; each key can be set to expire after 30 or 90 days, or never.

API key security best practice

Store keys securely: never commit them to source control or paste them into shared documents or chats.
Treat a key like a password: anyone with it can act as you against the API.
Rotate regularly: periodically create a new key and delete the old one.
Delete on exposure: if a key may have leaked, delete it straight away and issue a replacement.
Use one key per integration where practical, so you can delete a single integration's key without affecting others.

For the full list of endpoints, request and response formats, and example requests, see the GitLaw Public API Reference. If you would rather not write code, the Zapier integration offers a no-code alternative.

Frequently asked questions

When can I see the full API key?

Only once, at creation time. Copy and store it securely then. If you lose it, create a new key and delete the old one.

What happens to systems using a deleted key?

Deletion is permanent: the key stops working immediately and requests using it receive a 401 Unauthorized response. Create and deploy a replacement key before deleting the old one to avoid downtime.

Reviewed by the GitLaw team. Last updated 29 July 2026.