API keys

Keys to query the platform from your own programs and integrations.

API keys let you call the platform from outside the panel: a script, an integration or an automated process that needs to search or ask without a person being signed in.

Each key belongs to the organisation you created it in and only grants access to its content.

Creating a key

You can give it a name when you create it. It is not required, but it helps: it is the only thing you will see afterwards to know what uses it ("CRM integration", "Reporting script"). If one has to be revoked tomorrow, the name is what tells you which.

The full key is shown only once, right as you create it. Copy it then and store it wherever it belongs. Afterwards the list only shows its first few characters, enough to identify it, and the platform cannot give it back to you.

If you lose a key, the fix is to revoke it and create another.

Using it

The key goes in the x-api-key header of each request. It replaces the session: where a person uses the panel with their account, a program uses its key.

Check the API documentation for the detail of the available endpoints.

The most common case is connecting an AI assistant (Claude Code, Cursor, VS Code) to the platform's MCP server: that is explained step by step in Connect your AI assistant.

Revoking

Revoking a key invalidates it immediately: any program using it will start getting authentication errors on its next request.

There is no grace period and no way to reactivate it, so before revoking a key that is in production it is worth having its replacement ready.

Recommendations

One key per integration, not one shared between several. That way you can revoke one without leaving the others without service.
Treat them like passwords. Do not write them into your code or commit them to a repository: they belong in environment variables or whatever secret manager you use.
Revoke the ones you stop using. A forgotten key keeps working indefinitely.

Updated on Aug 05, 2026