API keys
API keys is the list of every key that reads this brand: the ones behind your MCP connections, the ones the CLI uses, and any you made for your own API calls. It is the page that answers "what is still connected to this brand, and what can it do?"
Find it under Workspace in the brand's sidebar.
The list
One row per key. The Key column shows the name over the first characters of the key itself, which is all the server keeps: the full value is shown once, at the moment it is created, and never again. A key carries a Default badge when it was minted with its project. Creating a project no longer makes one, so only older keys have it.
The rest of the row:
- Scope, either Project for a key bound to one project or Brand for one that reaches every project in the brand.
- Project, the project a project-scoped key serves.
- Permissions, the preset the key's scopes match, or a count when they match no preset. Hover it to see the full grant, every scope ticked or not, plus whether the key can authorize an OAuth connector.
- Status: Active, Expired, or Revoked.
- Created and Last used. Both sort. A key that has never been used has no date, and sorts last either way.
Columns adds three more that are off by default: Created by, OAuth, and Expires. Search by name or by the visible part of the key, and filter by project or by status.
Create a key
Create API key opens the same form the Connect your AI tools dialog uses.
Check the project
The key reads one project: its brand's ruleset plus that project's own overrides. The dialog starts on the brand's newest project, and shows a Project picker in its header only when there is more than one to choose from. If the brand has no project at all, the dialog offers to create one instead, because there is nothing to connect yet.
Name it
Optional. It is only how the key reads in this list, so name it after where it is going, such as Cursor MCP. Leave it blank and one is generated for you. You can rename it later.
A name has to be free within the project it belongs to, or within the brand for a brand-scoped key. Reusing one lands on the name field as "Another active key already uses this name."
Choose what it can do
Start from a preset: Full access, Read only, Delivery only, or None. Then tick individual scopes if you want something in between. They are grouped as Delivery (reading the ruleset, tokens, and exports), Agent sessions (notes, usage, feedback), and Authoring (writing rules, rule groups, tokens, and visibility). Delivery only is enough to serve a tool. See the MCP tools reference for which tool needs which scope.
Decide about OAuth
Under Connectors, Allow OAuth sign-in is ticked by default. When you connect a tool by signing in, UI Rules uses your newest active key for that project that has this ticked, and makes a new one if you have none. It can only be turned on when the key is created, never added afterwards, so leave it ticked unless you are sure you will never sign a tool in with this key.
The key is shown once, in full, on the screen that follows.
Copy it before you close the dialog. It will not be shown again, and nothing in UI Rules can recover it. Your other keys keep working until you revoke them, so if you lose one, revoke it and create another.
Rename a key
The row menu has Rename. The name is the only thing a minted key lets you change: its permissions, its project, and its secret are fixed when it is created. A name has to be free within the key's own project, or within the brand for a brand-scoped key, so a name a live key there already holds is refused; revoked keys do not hold their names.
Revoke a key
The row menu has Revoke API key. Anything still using that key stops working straight away, whether that is an editor's MCP connection or your own API calls, and it cannot be undone. Create a new key to restore access.
Revoking is what to do when a key has leaked, when a tool no longer needs your brand, or when someone who set a key up has left. Creating a new key does not affect the old ones, so revoking is the only thing that ends access.
