/api/console/v1/graphql) or MCP API (/api/mcp/v1) must include a valid API key.
Create an API key
Use the API key
Pass your API key as a Bearer token in theAuthorization header of every request.
GraphQL example
MCP example
Error responses
If the API key is missing or invalid, the API returns a401 Unauthorized response.
Key rotation best practices
- Create a new key before revoking the old one to avoid downtime in your integrations.
- Use one key per integration or application — this makes it easy to revoke access for a single service without affecting others.
- Set a reminder to rotate keys periodically, especially if team members with access have left your organization.
- Revoke keys immediately if you suspect they have been compromised.
API keys are personal — they act on behalf of the user who created them and inherit that user’s permissions. Use an account with the appropriate role for your integration’s needs.