> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Manage the workspace API key for workers, MCP servers, and API clients in OASM

The **API Keys** section (under **Settings → API Keys**) manages the credential used for programmatic access to a workspace. Its subtitle summarizes the scope: *"Manage your workspace API keys"*.

A workspace API key is a secure credential that identifies automated tools and integrations and proves they are allowed to interact with that workspace. It is how you connect workers, AI assistants (through the [MCP server](/settings/mcp)), and your own tools and integrations — anything that needs programmatic access to the workspace.

## Key concepts

Each workspace has **one active API key at a time**, which keeps credential management simple: one secret to protect, one secret to rotate.

## View the API key

<Steps>
  <Step title="Open Settings → API Keys">
    Navigate to the API Keys section of your workspace.
  </Step>

  <Step title="Inspect the current key">
    The page shows the active key. When no key exists yet, the page displays the placeholder **No API key available** and the **Copy** button is disabled.
  </Step>

  <Step title="Copy the key">
    Use the **Copy** button to copy the key into your clipboard and store it securely.
  </Step>
</Steps>

## Create or rotate the API key

<Steps>
  <Step title="Open Settings → API Keys">
    Navigate to the API Keys section.
  </Step>

  <Step title="Click Rotate">
    The **Rotate** button creates a new key for the workspace.
  </Step>

  <Step title="Copy the new key">
    Copy the freshly generated key immediately — it is shown once and you will not be able to retrieve it again later.
  </Step>
</Steps>

<Warning>
  **Keep your API key secure. Do not share it publicly or commit it to version control. Rotating the key will invalidate the current one.**
</Warning>

<Accordion title="What happens when I rotate the key?">
  Rotation replaces the workspace key. The previous key is invalidated immediately, so any worker, MCP client, or API integration still using the old key stops working until it is updated with the new one.
</Accordion>

## Use cases

<Table>
  | Use case           | How the key is used                                                                                          |
  | ------------------ | ------------------------------------------------------------------------------------------------------------ |
  | Connecting workers | Workers authenticate with the workspace API key to pull and execute scan jobs — see [Worker](/worker)        |
  | MCP server access  | The MCP server uses the key to let AI assistants query your workspace data — see [MCP Server](/settings/mcp) |
  | API clients        | Custom tools and integrations authenticate with the workspace key                                            |
</Table>

## Best practices

* Treat the API key like a password — never share it publicly or commit it to version control.
* Store keys in a secret manager or environment variables, not in source code.
* Rotate the key regularly and whenever a team member who had access to it leaves.
* After rotating, update every consumer (workers, MCP clients, API scripts) before the old key is needed again.
* Revoke access by rotating the key when you suspect exposure — rotation is the only invalidation mechanism.

## Related

<Card icon="cpu" title="Worker" horizontal href="/worker">
  Connect the execution layer to a workspace with an API key
</Card>

<Card icon="plug" title="MCP Server" horizontal href="/settings/mcp">
  Authenticate AI clients against the workspace MCP server
</Card>

<Card icon="scroll-text" title="Audit log" horizontal href="/audit-log">
  Track API key creation and revocation events
</Card>

<Card icon="users" title="Members" horizontal href="/members">
  Control which members can manage the workspace API key
</Card>