API keys
Allocait generates every API key on its own servers and stores only a SHA-256 hash of it, never the key itself. Because only the hash is stored, a key can’t be read back from the database. A key starts withalc_, which makes it easy to recognize, and you can set it to expire after 90 days or 1 year.
Each key has its own access, Read only or Read and change. You choose it when you create the key in Settings > API keys. See Access levels.
When a key is read-only, the server refuses every write tool. If an account’s access drops to read-only, its write keys work read-only.
A key shows Inactive in Settings when it has gone more than 30 days without use, counted from its creation if it was never used.
Connected apps
When you connect an agent such as Claude by signing in through the connector, you choose what it may do:- Read only is the default, and it covers your whole account. The app can see everything in it, not only portfolios.
- Changes are your choice. The app can add, change or delete data only if you choose Read and change.
- Removal takes effect on the app’s next request. Remove an app in Settings > Apps. Anything it already changed or created stays.
Rate limits and account access
Agent requests are rate-limited per account; see Rate limits for the budgets. Agent access depends on the account: some accounts read and check only, and others also change data and use webhooks. See Access levels. An account that can’t use agent access gets one403 text that says to manage the account in the Allocait app. A key that still exists stops working for new calls when the account loses access.
Related
- Authentication: create a key and set its scope.
- Security: what Allocait does and never does with your data.