Use API keys and MCP

Settings → API Keys manages credentials for integrations and agents. API Reference lists the REST endpoints and MCP tools.

Issue a restricted key

As an admin, choose the key’s actor type, read/write scope, allowed modules and whether customer-facing sends are allowed. Copy a new key when shown and store it privately. Revoke keys you no longer use.

Use the workspace URL

Use the base URL displayed in API Reference for REST /api/v1 and MCP /mcp. Authenticate with a Bearer key. The documentation catalog is a reference, not a grant of access to every listed tool.

Follow authorization

MCP discovery filters tools for the key and is paginated; follow nextCursor. Restricted combined-context requests are rejected as a whole. Deactivating a key’s creator revokes their keys. A role downgrade does not automatically rewrite existing key permissions.

Review sends

Customer-facing sends may wait in Agents → Approvals. The initiating key’s module restrictions and send/approval requirements remain in force throughout API-triggered workflows. Approving does not override them.

Client compatibility

The local MCP protocol fixture is tested. Compatibility with a particular hosted assistant/client must be verified separately; a configuration example is not proof that every client supports that connection.

Reviewed against the application on September 11, 2026. Available actions depend on your role and workspace configuration.