Create a sandbox API key from the dashboard, CLI, or MCP, store it on your server, and rotate it safely.
An API key gives your server access to one Commet organization. Start with a sandbox organization while building your integration.
Sandbox and live keys both start with ck_. The organization that created the key determines its environment; you cannot tell sandbox from live by reading the prefix. Both use https://commet.co/api/v1.
Choose the path that fits where you are working. You only need one to get started.
Local development.Install the Commet CLI, sign in through your browser, and link the project to your sandbox organization:
npm install -g commet
commet login
commet linkChoose the organization marked sandbox. Linking a new organization generates a key for CLI resource commands and saves it in .commet/config.json. The CLI adds .commet/ to .gitignore. Keep that directory private.
This configures the CLI; it does not set COMMET_API_KEY for your application. To create a separate application key after linking:
commet api-keys create --name "Local development" --expires-in-days 365Save the returned apiKey as described below. Resource commands use COMMET_API_KEY from the environment before the linked project's key, so check which credential is active before creating or deleting keys.
Connect your agent to the Commet MCP server at https://commet.co/mcp/v2. With OAuth, you can sign in through your browser and select a sandbox organization without an existing API key. The connection stays fixed to that organization.
Ask the agent to create an application key using api_create_api_key with these arguments:
{
"body": {
"name": "Local development",
"expiresInDays": 365
}
}The response contains the full secret only once. Have the agent store it directly in the intended local secret file or secret manager when your tools support that. Do not paste an existing secret into the conversation or ask the agent to repeat it in a message.
Already authenticating with an API key? You can create replacements with POST /api/v1/api-keys. That request needs an existing key and creates another key for the same organization. See Create API key for the request and response.
For local development, save the key in a git-ignored environment file:
COMMET_API_KEY=ck_replace_with_your_keyLoad this variable into your server process using your framework's environment support. For production, use your deployment's secret store. Never expose the key in browser code, public environment variables, logs, screenshots, or source control.
Commet stores a hash of the key and cannot show the full secret again. If you lose it, create a replacement.
For Node.js, install the SDK:
npm install @commet/nodeInitialize it in server code after loading the environment:
import { Commet } from "@commet/node"
const apiKey = process.env.COMMET_API_KEY
if (!apiKey) {
throw new Error("COMMET_API_KEY is required")
}
export const commet = new Commet({ apiKey })For other languages, follow the Python, Go, Java, or PHP integration guide. Direct REST requests authenticate with the x-api-key header.
Use a separate key for each application or deployment that needs independent rotation. To replace a key before it expires:
For production, create a key in your live organization and store it separately from sandbox credentials. Do not copy sandbox customer, plan, or subscription IDs into live configuration. Before switching, verify checkout, webhooks, and a renewal in sandbox with the Test Clock.
Next, follow the quickstart to complete your first subscription payment in sandbox.
How is this guide?