Skip to content
All documents

API Keys and MCP

View as Markdown
Ask AI
ChatGPT Claude

Create API keys and integrate externally through MCP.

Overview

An API key is a credential that grants secure access to the platform through external tools rather than through the interface. Normally you use the platform by signing in from a browser; but when you want another piece of software, an automation or an AI assistant to talk to the platform on your behalf, you give that tool an API key. The key defines who that tool is and what it can access.

MCP is a bridge that lets AI tools connect to the platform securely. With an MCP connection and a valid API key, an AI assistant can read your data on the platform and perform the actions you have allowed — for example listing projects or creating tasks. This lets you use the platform in natural language, simply by talking to your assistant.

API keys are sensitive information. A key is shown in full only at the moment it is created; for security it can never be viewed again afterward. That is why it is important to save the key somewhere safe the moment you generate it.

Who uses it

  • Developers and integration owners: Generate and manage keys to connect the platform to other systems or automations. They create keys from the API Keys section in the profile menu.
  • Teams using an AI assistant: Generate a key to connect desktop AI tools to the platform and register it in the tool’s settings, so they can work with the platform through the assistant.
  • Organization administrators: Watch over security by monitoring which keys exist, when each was last used, and their usage records; they revoke a key if anything looks suspicious.

Step-by-step process

  1. Go to the API Keys section. Open the API Keys screen from the profile menu in the top right. You see your existing keys and the state of each.
  2. Create a new key. Click the new-key button and give the key a name that reminds you where you will use it (for example “Desktop Assistant” or “Automation”).
  3. Set an optional expiry date. If you want the key to become invalid automatically on a certain date, define a period. Choosing a reasonable date is a good habit even for long-lived access.
  4. Copy the key immediately. When created, the key is shown in full once. Copy this value and store it somewhere safe; you cannot see it again after you close the screen.
  5. Register it in your tool. Enter the key into the tool that will use it (an AI assistant, an automation or another system). For AI assistants, this means adding the key to the tool’s MCP connection setting.
  6. Monitor usage. Check the key’s usage records from time to time. If you see access you did not expect, revoke the key and create a new one if needed.

Creating a separate key for each tool is good practice, so revoking one key does not affect the others.

Process flow

flowchart TD
    A[Go to the API Keys section] --> B[Create a new key]
    B --> C[Give a name and optional expiry date]
    C --> D[Copy and store the key immediately]
    D --> E[Register it in your tool or assistant]
    E --> F[The tool connects securely via MCP]
    F --> G[It performs the actions you allowed]
    G --> H{Any suspicious usage?}
    H -- Yes --> I[Revoke the key]
    H -- No --> J[Keep monitoring usage]

Frequently asked questions

What is the difference between an API key and normal sign-in? Normal sign-in applies while you use the platform from a browser and is short-lived. An API key lets an external tool talk to the platform on your behalf, without an interface, and stays valid until you revoke it.

What exactly does MCP do? MCP is a bridge that lets AI tools connect to the platform securely. Through this bridge and a valid key, your assistant carries out work on the platform within your permissions — for example listing projects or creating tasks.

What do I do if I lose my key? Since a key is never shown again, a lost key cannot be recovered. What you should do is revoke the old key, create a new one and register it in your tool again.

How long does a key stay valid? If you do not set an expiry date, the key stays valid until you revoke it. If you prefer, you can define a date when creating it so the key becomes invalid on its own at that time.

What happens if a key falls into the wrong hands? The key lets whoever holds it act with your access. That is why you should revoke a key immediately if anything looks suspicious; a revoked key becomes invalid instantly and can no longer be used.

Why is a separate key recommended for each tool? Separate keys mean the others keep working when you revoke one tool. They also make it easier to track which key is used where and to quickly shut down a key that causes trouble.