API keys and MCP connections

Create a keyCopy Anchor Link

A key can only be given capabilities an administrator on the main project has switched on: Organisation settings in the switcher, the Agents tab, Agent access, then Save Agent Access.

1. Select the key's organisation in the switcher; see roles and permissions for what your role allows.

2. Select your name in the sidebar, choose API keys, then New API key.

3. Enter a Name for the tool, not the person, and choose the Type: User for your own scripts and the REST API, or Agent for an AI agent connecting over MCP.

4. For an agent key, tick only the Capabilities it needs. The dialog shows each as a scope name; the Agents tab shows them by label:

   In the dialog	On the Agents tab	Lets the key
   agent:vuln-triage	Vulnerability triage	Triage findings and vulnerabilities, record or import findings, add the assets they sit on, and record or withdraw VEX statements about product versions
   agent:compliance	Compliance management	Work on assessments, scores, evidence and control mappings, enable, disable or import frameworks, change compliance preferences, and approve or reject proposals
   agent:controls-risks	Controls & risks	Create, update and delete controls, risks and actions

   A key with nothing ticked can read, chat with the AI Sidekick and file proposals under Tasks › Inbox.

5. Set Expires in (days), then select Create key.

6. Copy the token into a password manager, then select I've saved it.

The token is shown once. To take a capability away from keys that already have it, revoke those keys. To use the key, see Connect an agent.

What stays in the appCopy Anchor Link

Some account and organisation tasks are done by a signed-in person in the app.

Rotate a keyCopy Anchor Link

To rotate a key or change its capabilities, create a new key, put its token into the agent or script, then revoke the old one.

Stop an agent (disconnect or remove)Copy Anchor Link

An API key is a bearer credential: revoke it when it leaks or you no longer need it.

1. Select your name in the sidebar, then API keys.
2. Find the key by Name.
3. Select the bin icon on its row, then confirm with Revoke key.

A revoked key stops working. The list opens on active keys; to see revoked or expired ones, choose them under Status.

Revoking does not undo the agent's changes. Reject any of its pending proposals you no longer want under Tasks › Inbox.

To see or revoke other people's keys, an administrator on the main project chooses Organisation settings from the switcher, then the API Keys tab. To revoke several, tick them, choose Revoke, then confirm.