API keys
Pass your key as a bearer token on every request:Server-side only
A key can place calls and read client data. Keep it in environment variables
or a secret manager, never in frontend code.
Scoped to your firm
Keys resolve to one firm. Requests that name another firm’s
firmSlug are rejected.Dashboard sessions
Requests from the Lawtte dashboard are authenticated by the signed-in session cookie instead of a key, which is why the same endpoints power both. Session requests are additionally checked against the signed-in user’s role and firm.The Claude connector
The Lawtte connector for Claude does not use API keys. It uses OAuth: Claude redirects you to Lawtte, you sign in, pick one Studio calling agent, and approve the call tools. Access can be revoked at any time from Dashboard → Connect. See connect Claude.Rotating and revoking
1
Rotate a key
Email contact@lawtte.ai to have a new key issued and the old
one retired. Keys are stored only as hashes, so a lost key cannot be recovered — it has to be replaced.
2
Revoke a connector
Open Dashboard → Connect, find the app under connected apps, and choose
Disconnect. Access ends immediately.