An access key is a string that Bitrix24 uses to identify your app. Without a key, an app cannot read deals, create tasks, or send messages. If you revoke a key, the app loses access to data right away.

Key types in Alaio Vibecode

Choose a key based on what your application needs to do. Each key type has its own purpose:

• API key — lets an application, bot, or server integration work with Bitrix24. This is the main key type. Create it when you need to connect an application to Bitrix24.
• Auth key — use it for applications that employees sign in to. The application works with the permissions of the employee who signed in, rather than the application owner's permissions.
• Management key — use it for service scripts that create, view, replace, or disable API keys. It does not give the application access to deals, tasks, messages, or other account data.

How to choose a key. For a bot, application, or integration, create an API key. If the application needs to identify an employee after login and work with that employee's permissions, use an authorization key. Create a management key only for scripts that manage API keys automatically.

API key

Use an API key for the application to work with Bitrix24. For example, to receive requests from a site and add them to the CRM.

Create an API key when you:

• Connect a new application or bot
• Set up a server integration
• Want to give a separate script access to the application
• Replace a key that may have been exposed to third parties

Use separate keys for different applications and environments, such as test and production. This way, replacing one key won't affect the others.

Create an API key.

1. Open the Access > API Keys section.
2. Click Create Key.
3. Enter a name that clearly describes the key's purpose. For example, CRM dashboard or Site-CRM integration.
4. Choose an access mode:
• Read only — the application can only retrieve data. For example, for a CRM dashboard.
• Read and write — the application can create or modify data. For example, to add requests to the CRM.
5. In the Access permissions block, select only the sections you need. For a CRM dashboard, CRM access is enough. You don't need permissions for tasks, chat, or other sections.
6. Choose the key's expiration date. If needed, also set a request limit per minute.
7. Click Create.
8. Copy the key and save it in a secure location. The full value is shown only once.

The API keys section shows the key name, available permissions, number of requests, date of last use, and status. This helps you see which key an application uses and whether you still need it.

Use the API key. After you create the key, Alaio Vibecode shows the API key and a ready-made prompt for an AI agent. The prompt includes the key, a link to the documentation, and instructions for creating the application or bot.

1. In the key window, click Copy prompt.
2. Paste the prompt into Claude Code, Codex, or Cursor.
3. Add a task description. For example, Build a CRM dashboard with sales department metrics for the month.
4. The AI agent creates the application and deploys it to a server.

If the key has Read only access to the CRM, the AI agent can create a dashboard that retrieves deal data and generates a report. Such an application won't be able to modify or create deals.

Auth key

Use an authorization key when the application needs to identify who signed in and display data based on that employee's permissions.

For example, suppose you create an application for employees to sign up for a company party. Each employee can create and view their own request, while the host can view requests from all employees.

Create an authorization key.

1. Open the Access > Auth Keys section.
2. Click Create Key.
3. Enter a name. For example, Company party sign-ups.
4. Choose an access mode: Read only or Read and write.
5. If the application needs to open in the Bitrix24 mobile app, enable Supports the Bitrix24 mobile app. You can't change this parameter after creation.
6. In the Access permissions block, select only the sections you need.
7. Click Create.
8. Copy the key and the ready-made prompt for the AI agent. You can see the full key only once.

Use the authorization key.

1. In the key window, click Copy prompt.
2. Paste the prompt into Claude Code, Codex, or Cursor.
3. Add a task description. For example, Create an application for employees to sign up for a company party.
4. The AI agent creates the application and deploys it to a server.

The AI agent creates the application. If you need to open it inside Bitrix24, click Embed into Bitrix24 in the list of authorization keys.
Alaio Vibecode: Choose integration points for an app

Management key

Use a management key for a script that manages API keys through the REST API. If you create and replace API keys manually in the admin panel, you don't need one.

For example, suppose each new project needs its own API key. A script with a management key calls the key management API, creates an API key, and passes it to the project setup process. This way, you don't have to create a key manually every time.

Don't use a management key in an application instead of an API key. It doesn't grant access to CRM, tasks, chats, or other account data. To work with this data, the application needs an API key.

Create a management key.

1. Click the avatar in the top-right corner.
2. Select Management Keys.
3. Click Create Key.
4. Enter a clear name. For example, Scheduled key rotation.
5. Choose a mode:
• Read only — the script can only view the list of keys.
• Read and write — the script can create, modify, or disable keys.
6. Select the permissions you need:
• API keys management — create, replace, and delete API keys.
• Bitrix24 account read — retrieve the list of available accounts.
• Tickets review — work with tickets. This permission is available to users with the platform-admin role.
7. Click Create.
8. Copy the key. You can see the full key only once.

Use the management key. Pass the management key in the X-Api-Key header when the script calls the key management API /v1/keys/*. There is no ready-made AI agent prompt when you create a management key.

1. Create a separate management key for each script.
2. Store the key in CI/CD secrets or a secrets manager. Don't add it to the script's code.
3. Select only the permissions you need. If the script only checks the list of keys, Read only mode is enough.
4. Add the key to the script's settings. When it runs, the script will pass the key to the API and can perform the allowed actions with API keys.
5. When you no longer need the script, disable or delete its management key.

Reissue a key

Reissue a key when you need to replace its value without creating a new application. For example, you can reissue a key as part of a scheduled rotation, when you transfer an application to another employee, or if the key may have been exposed.

When you reissue a key, Alaio Vibecode creates a new one. The application, server, embeddings, deployments, and access permissions remain the same.

1. Open the Applications section.
2. Select the application you need.
3. In the Key row, click Reissue key.
4. Leave Update the key on the server and restart the app enabled if the key is stored in the application's environment variables. Alaio Vibecode replaces the key value and restarts the application. Any open connections are interrupted during the restart.
5. Click Replace key.
6. Copy the new key and save it in a secure location. You can see the full key only once.
7. Update the key in any external integrations that use the old value.

During a regular reissue, the old active key keeps working for another 24 hours. Use this time to update external integrations. After 24 hours, the old key stops working.

If a key is blocked. Alaio Vibecode can block a key if it is publicly exposed. The application form shows the key as Blocked, and the application can no longer access Bitrix24 data.

Reissue the key using the same steps. The 24-hour transition period doesn't apply to blocked keys.

If Alaio Vibecode can't update the key on the server. After you replace a key, Alaio Vibecode shows the result in the same window. Follow the steps for the message you see:

• Key updated on server, application restarted — no action needed.
• Application server unavailable — key not updated in its environment — open the app server form in the Black Hole > Servers or Galaxies section. If the server is stopped, click Wake up. Once the server starts, return to the application form and replace the key again.
• Key not found in server environment variables or Failed to update key on server — Alaio Vibecode couldn't replace the value automatically. Copy the new key and open the AI tool you used to create the application. Ask it to replace the old API key with the new one in the application settings and redeploy it.
• Key updated on server, but failed to restart application — restart the application manually.

For an active key, the old value keeps working for another 24 hours. If the old key is blocked, update the environment variable and restart the application immediately. The blocked key no longer works.