API keys, logs and MCP

API keys let your own systems, and any MCP-compatible AI assistant, reach your workspace's data. This page is the admin side: issuing and scoping keys and watching their use. How to call the API is in the Build track.

Before you start: a role with Manage API keys. Decide first whether the key should reach real data or test data; that is set by sandbox mode at the moment you generate it and cannot be changed afterwards.

Generate a key

Settings → API Keys → Generate Key. Give it a name that says what will use it, such as "Zapier Integration". The key is shown once, with the warning "Store this key securely. You won't be able to see it again after closing this dialog." Copy it before clicking Done.

Keys generated with sandbox mode on start sk_test_ and only see test data; with it off, sk_live_. One key per integration, so a leak or a retired system costs you one key.

Scope it

The pencil on a key's row opens its permissions: a matrix grouped by area with Select all and Clear all per group, listing only the permissions the API actually enforces. A key with no permission for an endpoint gets a 403 from it. Permissions can be changed after creation; the key itself cannot.

Deactivate stops a key immediately. There is no reactivate; generate a new one.

Watch what keys do

Settings → API Logs lists every request made with your keys: time, method, endpoint, which key, the response status, and how long it took. Filter by key or method. This is where to look when an integration says it is failing: the status column tells you whether it is being refused, and the endpoint tells you what it tried.

Connect an AI assistant over MCP

Settings → MCP connects any MCP-compatible assistant to your data, so it can read and manage contacts, accounts, opportunities, tickets, leads, tasks, the knowledge base, invoices, quotes, activities, and a dashboard summary. The setup is three steps, spelled out on the page:

1. Generate an API key as above.
2. Copy the configuration block and paste it into your MCP client's config file, replacing the placeholder with the key.
3. Restart the MCP client.

The key's prefix decides whether the assistant sees sandbox or live data. The page's Available Tools list shows what the assistant can do, group by group.

When it goes wrong

• You closed the dialog without copying the key. It cannot be recovered. Deactivate it and generate another.
• An integration gets 401. The key is wrong, deactivated, or being sent to the other side of the sandbox divide. The Authentication guide explains the three 401 codes.
• An integration gets 403. The key lacks that permission. Edit its permissions.
• The MCP assistant sees no data. Its key is sk_test_ and the workspace has no sandbox data, or the config still has the placeholder.
• You expected a test-or-live choice in the key dialog. There is none; sandbox mode at generation time decides. See Sandbox mode and test data.