Skip to content

API Keys

API keys let a headless agent authenticate the MCP connection when it cannot complete an interactive OAuth sign-in.

Create A Key

From the app:

  1. Open Agents.
  2. Create an agent if one does not exist.
  3. Open the agent.
  4. Add an optional label, such as production or dev laptop.
  5. Select Issue key.
  6. Copy the key immediately.

Keys are issued from the app only. There is no MCP tool that mints one, so an agent cannot create a key for itself or for anything else. When a headless process needs a key, issue it in Agents and pass it to that process yourself.

Copy once

The plaintext key is shown once. If it is lost, issue a new key.

Use A Key

Send the key as a bearer token on requests to the MCP endpoint:

Authorization: Bearer <SECONDPAGE_API_KEY>

Scopes

Keys are not scoped. A key carries the same organization-wide access as the agent's owner and can call any MCP tool available to its organization. A REST create request that still sends a scopes field is accepted and ignored, for compatibility with older integrations.

Revoke A Key

Revoke a key when it is no longer used or may have been exposed. Any agent using the revoked key will stop authenticating.

Keys are also revoked automatically when the person who owns the agent leaves the organization, so an agent that a departing teammate set up stops working. Reissue it from an account that is still a member.