Create and revoke an API key
A key lets a tool or AI client work with your workspace, with the role of the member who made it. Create one, use it, and revoke it when the job is done.
The NioConnect teamUpdated 3 min readOn this page
- Time
- About 3 minutes
- You need
- A tool that takes a key
- Where
- Settings, then Developers
Before you start
A key acts with the permissions of the member who creates it, so create it from the account whose role suits the tool. That role is read on every call: demote or remove the member and their keys are limited on the very next use. A key does not widen your plan either.
Not every client needs a key. Claude Desktop, claude.ai and ChatGPT connect with a web address and a consent screen where you press Allow, with nothing to paste. Claude Code and Cursor take a key in their configuration. The AI pages cover each client.
If you are unsure which route to take, prefer the sign in route where a client offers it. Nothing is pasted, nothing sits in a file on your machine, and you can see and revoke each authorised client under Settings, then Developers.
Create, use, revoke
Treat a key like a password.
- Open Settings, then Developers, and create a key.
- Name it after the tool, so you can tell your keys apart.
- Copy the key when it is shown. It appears once and cannot be shown again.
- Paste it into the tool, using the snippet below for your client.
- Revoke the key as soon as the tool no longer needs it.
Paste it into your client
The Developers page generates these blocks with your server address filled in. The key is shown here as a placeholder; replace it with yours.
claude mcp add --transport http nioconnect <your server address> --header "Authorization: Bearer <your key>"{
"mcpServers": {
"nioconnect": {
"url": "<your server address>",
"headers": { "Authorization": "Bearer <your key>" }
}
}
}What you should see
Your new key appears in the list with its name and a last used time that fills in after the first call. Only a one way hash of the key is stored, so no screen can show it to you again. Creating and revoking a key are both written to the audit log; individual calls are not.
If something goes wrong
| What you see | What it means | What to do |
|---|---|---|
| The tool says it is not authorised | The key was mistyped, revoked, or the member behind it lost their role | Check the key against your list, or make a new one |
| You lost the key | It is shown only once | Revoke it and create a new one |
| You think a key leaked | Anyone holding it can use it until it is revoked | Revoke it first, create a new one after, and check the calendar for drafts you did not expect |
Good habits
Name keys for the job and the person, such as the tool and the month you made it, so a list of six keys still tells you which one is safe to remove. Review the list now and then, because a tidy list is the easiest security habit there is: a key with no recent last used time and no reason to exist is a key to revoke. Remember that a key is only as safe as the place it is stored, so keep it in the tool’s own configuration and not in a file you commit to a shared repository.
Use one key per tool, so revoking one never breaks another. Never paste a key into a public place, a shared document or a chat. Revoke when a job ends; access stops immediately.
An assistant’s post goes through the same checks and approvals as yours. See what an AI draft can and cannot do.
Check your result
- Confirm the key is listed under Settings, then Developers, with the name you gave it.
- Ask the tool to list your channels and see it answer.
- Look for a last used time on the key.
- Revoke any key you no longer need.
Written by The NioConnect team.
Posts that say why they failed, on one calendar.
Start 7-day trial