API keys

Creating a key#

1. Open Manage account → API keys.
2. Create a key and give it a name that says where it's used ("Cursor — laptop", "CI").
3. Copy it immediately. The full key is shown once.

Rotating#

Rotating issues a new secret for the same key. Anything using the old value stops working the moment you rotate, so update your configuration in the same sitting.

Revoking#

Deleting a key is immediate and permanent. Any IDE or script using it starts failing right away — which is exactly what you want if a key has leaked.

Keeping keys safe#

• Never commit a key. Use your IDE's MCP settings or an environment variable.
• One key per place. A shared key can only be revoked by breaking every consumer at once.
• Rotate when someone leaves, or when a key has been anywhere it shouldn't.

If a key stops working#

Check, in this order: the key wasn't rotated or revoked; it was pasted whole; and you're pointing at the right account. Keys are per-user, so a key from a colleague's account won't see your projects.