API keys

API keys are how everything outside the app — the MCP server, the ct CLI, your own scripts — authenticates with your workspace.

Creating a key

In the app, open Settings → API Keys and create a key. Copy it when it’s shown and store it somewhere safe, like the secret store your agent already uses.

Using a key

• MCP (hosted): send it as a Bearer token — Authorization: Bearer <your-api-key>
• MCP (local): pass it as the API_KEY environment variable
• CLI: ct login stores it locally for you

One key per agent

Create a separate key for each agent or integration rather than sharing one. Scoped keys keep an agent working across sessions without a chat client running, and revoking one agent’s access never disturbs another’s.

Rate limits

API traffic is rate limited per key. Well-behaved agents stay far below the limit; if a runaway loop hits it, requests are rejected with a standard 429 response and a Retry-After header until the window resets.