# API keys

An API key lets an unattended script or agent call Connector Central with no person in the loop. An API key is a workspace-bound bearer credential. It authenticates to the REST API and `/mcp` in the same `Authorization: Bearer` header as an interactively issued access token.

An API key is **not** an OAuth client ID or client secret. It does not start an authorization-code flow, open browser consent, issue refresh tokens, or let a client exchange it for another token. AI clients that require OAuth discovery and browser consent must use the normal OAuth connection flow. A programmatic MCP client that supports a fixed Bearer header can use an API key directly.

## Availability and roles

Groups and API keys are included in the Growth and Enterprise plans. See [pricing](/pricing). Only admins and owners can create or manage keys.

## Create a key

1. Open **API Keys** under **Integrate**.
2. Select **Create API Key** and give the key a name that identifies one workload, such as `Month-end reporting`.
3. Copy the key value from the one-time reveal and put it directly into a password manager, deployment secret, or environment secret store.
4. Do not confuse the key's visible client ID with the secret key value. The client ID identifies the record; it does not authenticate requests.

The secret cannot be retrieved later. If it is lost, revoke the key and create a replacement.

## Give the key access

A new key has no connector access. Open its **Connectors** tab and select **Add connector**, or open a connector's **Access** tab and add the key there.

Access is configured per connector:

- Adding the connector supplies Read access.
- Write and Destructive are independent opt-ins.
- The same key can have different levels on different connectors.
- The key initially reaches every current and future active connected account for that connector. Use the access drawer to block accounts it must not reach, and review the setting after adding a new account.

The key never inherits access from the admin who created it, from a group, or from another key.

## Authenticate a request

Send the key only in the HTTP header:

```http
Authorization: Bearer REPLACE_WITH_API_KEY
```

For example, the same header can authenticate a request to the REST API or a Streamable HTTP MCP request to:

```
https://connectorcentral.com/mcp
```

Never put the key in a URL, query string, source file, Git repository, prompt, screenshot, or application log.

## Review use and revoke

The key's **Overview** tab shows its status, last use, recent call count, and recent activity. The workspace [Activity log](/docs/connectors-and-access/activity-log) labels calls made by the key so they can be filtered separately from user-authorized calls.

Revoke a key immediately when a workload is retired or the value may have leaked. Revocation stops every token issued for that key. Reactivating the record issues a new one-time key value; the old value remains unusable.

Use one key per workload, grant only the connectors and levels it needs, restrict connected-account reach where necessary, and review keys that have never been used or have not been used recently.

## OAuth or API key?

| Need | Use |
|---|---|
| A person connects ChatGPT, Claude, Microsoft Copilot, or another browser-based client | OAuth discovery, authorization code, and workspace consent |
| A script or service runs without a person and can set a Bearer header | API key, on Growth and Enterprise plans |
| A client asks for a client ID and redirect URI | Register an OAuth client; do not paste an API key as the client secret |

## Next steps

- [Manage connector and connected-account access](/docs/connectors-and-access/connectors-accounts-and-access-grants)
- [Review the REST API overview](/docs/api/overview)
- [Review the MCP server reference](/docs/api/mcp)