API and MCP

Create an API key

So something outside —a script, an integration, an agent— can come in under your name.

How to do it

1. Open the API keys and press “New key”.
2. Give it a name that says who will use it, and choose whether it expires in 30 days, 90, a year or never.
3. Copy it right then: it is shown once and after that it cannot be seen again.
4. Keys are handled by the owner or an admin of the organization: with any other role the screen opens and tells you who to ask, without showing a single one.

How to undo it. Revoking cuts that key off at once and does not undo: whatever uses it stops getting in until you hand it another.

Narrow down how far a key reaches

So one project integration does not reach the whole organization.

How to do it

1. Under scope, pick a project instead of the whole organization.
2. Tick “Include subprojects” only if it also has to reach whatever hangs from it, now and whatever is created later.
3. With no project, the key operates over the whole organization with the access of whoever creates it.

Hand over a key without cutting service

“Rotate” (in the key’s menu) cuts off the old one right away. If you can’t cut service, hand it over in three steps.

How to do it

1. Create the new key and deploy it wherever the old one is in use. If it’s an agent’s, give it its permissions first: a new key starts without the old one’s (rotating does keep them).
2. Watch the last-used column until the old one stops moving.
3. Then, and not before, revoke the old one.

How to undo it. The old key is revoked after the new one is deployed; the other way round locks out whatever was still using it.

Go over which keys are still alive

So no door is left open that nobody uses any more.

How to do it

1. The table gives each key its scope, when it was last used and when it expires.
2. Note in “Purpose” what it was issued for: it is text for whoever administers, and it changes nothing about what the key can do.
3. Copy the prefix to match a key against a line in a log.