API Keys and MCP

What is this for?

You normally use the platform in a browser. When another program, an automation or an AI assistant needs to work with the platform on your behalf, you give that tool an API key. An API key is a credential that defines who the tool is and what it can access.

MCP is a bridge that connects AI assistants to the platform securely. For example, with an MCP connection and a valid key, your desktop assistant can list your projects or create a new task.

Example scenario

Can is a project manager at a design agency. Every morning he wants to ask his desktop AI assistant, “Which projects are due this week?”

1. Can creates a new key named “Desktop Assistant” in the API Keys section.
2. He chooses a reasonable expiry date.
3. He copies the key immediately and stores it somewhere safe, because it cannot be shown again after the screen closes.
4. He adds the key to his assistant’s MCP connection setting.
5. He can now ask the assistant about his projects in plain language. If he sees access he did not expect, he revokes the key.

Who uses it

• Developers and integration owners: Create and manage keys that connect the platform to other systems or automations. They work from the API Keys section in the profile menu.
• Teams using an AI assistant: Create a key for a desktop assistant and enter it in that tool’s settings, so the assistant can work with the platform.
• Organization administrators: Monitor which keys exist and when each was last used, and revoke a key if something looks suspicious.

Step by step

1. Open the API Keys section. Go to the API Keys screen from the profile menu in the top right. You see your existing keys and their status.
2. Create a new key. Click the new-key button and give the key a name that reminds you where you will use it, such as “Desktop Assistant” or “Automation”.
3. Set an optional expiry date. If you want the key to become invalid on a certain date, define a period. Choosing a reasonable date is a good habit.
4. Copy the key immediately. After creation, the key is shown in full only once. Copy it and store it somewhere safe; you cannot see it again after you close the screen.
5. Register it in your tool. Enter the key in the tool that will use it. For an AI assistant, add it to the tool’s MCP connection setting.
6. Monitor usage. Check the key’s usage records from time to time. If you see access you did not expect, revoke the key and create a new one if needed.

Creating a separate key for each tool is good practice, so revoking one key does not affect the others.

Process flow

flowchart TD
    A[Go to the API Keys section] --> B[Create a new key]
    B --> C[Give a name and optional expiry date]
    C --> D[Copy and store the key immediately]
    D --> E[Register it in your tool or assistant]
    E --> F{Any suspicious usage?}
    F -- Yes --> G[Revoke the key]
    F -- No --> H[Keep monitoring usage]

Frequently asked questions

What is the difference between an API key and normal sign-in? Normal sign-in applies while you use the platform in a browser. An API key lets an external tool work on your behalf and stays valid until you revoke it.

What exactly does MCP do? It lets your AI assistant reach the platform’s information with your permission. For example, you can ask it to list projects or create a task.

What do I do if I lose my key? A lost key cannot be recovered, because it is never shown again. Revoke the old key, create a new one and register it in your tool again.

How long does a key stay valid? If you do not set an expiry date, the key stays valid until you revoke it. You can also set a date when you create it, so the key becomes invalid on that day.

What happens if a key falls into the wrong hands? Whoever holds the key can act with your access. If anything looks suspicious, revoke the key immediately; a revoked key stops working at once.

Why is a separate key recommended for each tool? When you revoke one tool’s key, the others keep working. It is also easier to see where each key is used and to shut down a problem key quickly.