Skip to main content
The API Keys section (under Settings → API Keys) manages the credential used for programmatic access to a workspace. Its subtitle summarizes the scope: “Manage your workspace API keys”. A workspace API key is a secure credential that identifies automated tools and integrations and proves they are allowed to interact with that workspace. It is how you connect workers, AI assistants (through the MCP server), and your own tools and integrations — anything that needs programmatic access to the workspace.

​
Key concepts

Each workspace has one active API key at a time, which keeps credential management simple: one secret to protect, one secret to rotate.

​
View the API key

1

Open Settings → API Keys

Navigate to the API Keys section of your workspace.
2

Inspect the current key

The page shows the active key. When no key exists yet, the page displays the placeholder No API key available and the Copy button is disabled.
3

Copy the key

Use the Copy button to copy the key into your clipboard and store it securely.

​
Create or rotate the API key

1

Open Settings → API Keys

Navigate to the API Keys section.
2

Click Rotate

The Rotate button creates a new key for the workspace.
3

Copy the new key

Copy the freshly generated key immediately — it is shown once and you will not be able to retrieve it again later.
Keep your API key secure. Do not share it publicly or commit it to version control. Rotating the key will invalidate the current one.
Rotation replaces the workspace key. The previous key is invalidated immediately, so any worker, MCP client, or API integration still using the old key stops working until it is updated with the new one.

​
Use cases

​
Best practices

  • Treat the API key like a password — never share it publicly or commit it to version control.
  • Store keys in a secret manager or environment variables, not in source code.
  • Rotate the key regularly and whenever a team member who had access to it leaves.
  • After rotating, update every consumer (workers, MCP clients, API scripts) before the old key is needed again.
  • Revoke access by rotating the key when you suspect exposure — rotation is the only invalidation mechanism.

Worker

Connect the execution layer to a workspace with an API key

MCP Server

Authenticate AI clients against the workspace MCP server

Audit log

Track API key creation and revocation events

Members

Control which members can manage the workspace API key