API keys
API keys is the list of every key that reads this brand: the ones behind your MCP connections, the ones the CLI uses, and any you made for your own API calls. It is the page that answers "what is still connected to this brand, and what can it do?"
Find it under Workspace in the brand's sidebar.
The list
One row per key. The Key column shows the name over the first characters of the key itself, which is all the server keeps: the full value is shown once, at the moment it is created, and never again. A key carries a Default badge when it is the one its project was created with, which is usually the one an editor is already wired to.
The rest of the row:
- Scope, either Project for a key bound to one project or Brand for one that reaches every project in the brand.
- Project, the project a project-scoped key serves.
- Permissions, the preset the key's scopes match, or a count when they match no preset. Hover it to see the full grant, every scope ticked or not, plus whether the key can authorize an OAuth connector.
- Status: Active, Expired, or Revoked.
- Created and Last used. Both sort. A key that has never been used has no date, and sorts last either way.
Columns adds three more that are off by default: Created by, OAuth, and Expires. Search by name or by the visible part of the key, and filter by project or by status.
Create a key
Create API key opens the same form the Connect your AI tools dialog uses.
Pick the project
The key reads that project: its brand's ruleset plus that project's own overrides. If the brand has only one project it is chosen for you.
Name it
Optional. It is only how the key reads in this list, so name it after where it is going, such as Cursor MCP. Leave it blank and one is generated for you. You can rename it later.
Choose what it can do
Start from a preset: Full access, Read only, Delivery only, or None. Then tick individual scopes if you want something in between. They are grouped as Delivery (reading the ruleset, tokens, and exports), Agent sessions (notes, usage, feedback), and Authoring (writing rules and tokens). Delivery only is enough to serve a tool. See the MCP tools reference for which tool needs which scope.
Decide about OAuth
Enable OAuth (Claude Desktop, claude.ai) is on by default. Those apps cannot paste a key, so they send you to UI Rules to approve access instead. It can only be enabled when the key is created, never added afterwards, so leave it on unless you are sure you will never connect them with this key.
The key is shown once, in full, on the screen that follows.
Copy it before you close the dialog. The full value is only available in that browser tab, and nothing in UI Rules can show it to you again. If you lose it, revoke the key and create another.
Rename a key
The row menu has Rename. The name is the only thing a minted key lets you change: its permissions, its project, and its secret are fixed when it is created. Names have to be unique across the organization, so a name a live key already holds is refused; revoked keys do not hold their names.
Revoke a key
The row menu has Revoke API key. Anything still using that key stops working straight away, whether that is an editor's MCP connection or your own API calls, and it cannot be undone. Create a new key to restore access.
Revoking is what to do when a key has leaked, when a tool no longer needs your brand, or when someone who set a key up has left. Creating a new key does not affect the old ones, so revoking is the only thing that ends access.
