API keys
Create, rotate and revoke keys for the MCP server and API access.
Last updated
Creating a key
- Open Manage account → API keys.
- Create a key and give it a name that says where it's used ("Cursor — laptop", "CI").
- Copy it immediately. The full key is shown once.
Rotating
Rotating issues a new secret for the same key. Anything using the old value stops working the moment you rotate, so update your configuration in the same sitting.
Revoking
Deleting a key is immediate and permanent. Any IDE or script using it starts failing right away — which is exactly what you want if a key has leaked.
Keeping keys safe
- Never commit a key. Use your IDE's MCP settings or an environment variable.
- One key per place. A shared key can only be revoked by breaking every consumer at once.
- Rotate when someone leaves, or when a key has been anywhere it shouldn't.
If a key stops working
Check, in this order: the key wasn't rotated or revoked; it was pasted whole; and you're pointing at the right account. Keys are per-user, so a key from a colleague's account won't see your projects.
Was this article helpful?