--- title: "API keys" description: "See every key that reads your brand, what each one is allowed to do, when it was last used, and revoke the ones you no longer want." label: "API keys" date: "2026-09-28" --- API keys is the list of every key that reads this brand: the ones behind your MCP connections, the ones the CLI uses, and any you made for your own API calls. It is the page that answers "what is still connected to this brand, and what can it do?" Find it under **Workspace** in the brand's sidebar. ## The list One row per key. The **Key** column shows the name over the first characters of the key itself, which is all the server keeps: the full value is shown once, at the moment it is created, and never again. A key carries a **Default** badge when it was minted with its project. Creating a project no longer makes one, so only older keys have it. The rest of the row: - **Scope**, either **Project** for a key bound to one project or **Brand** for one that reaches every project in the brand. - **Project**, the project a project-scoped key serves. - **Permissions**, the preset the key's scopes match, or a count when they match no preset. Hover it to see the full grant, every scope ticked or not, plus whether the key can authorize an OAuth connector. - **Status**: **Active**, **Expired**, or **Revoked**. - **Created** and **Last used**. Both sort. A key that has never been used has no date, and sorts last either way. **Columns** adds three more that are off by default: **Created by**, **OAuth**, and **Expires**. Search by name or by the visible part of the key, and filter by project or by status. ## Create a key **Create API key** opens the same form the **Connect your AI tools** dialog uses. ### Check the project The key reads one project: its brand's ruleset plus that project's own overrides. The dialog starts on the brand's newest project, and shows a **Project** picker in its header only when there is more than one to choose from. If the brand has no project at all, the dialog offers to create one instead, because there is nothing to connect yet. ### Name it Optional. It is only how the key reads in this list, so name it after where it is going, such as `Cursor MCP`. Leave it blank and one is generated for you. You can rename it later. A name has to be free within the project it belongs to, or within the brand for a brand-scoped key. Reusing one lands on the name field as "Another active key already uses this name." ### Choose what it can do Start from a preset: **Full access**, **Read only**, **Delivery only**, or **None**. Then tick individual scopes if you want something in between. They are grouped as **Delivery** (reading the ruleset, tokens, and exports), **Agent sessions** (notes, usage, feedback), and **Authoring** (writing rules, rule groups, tokens, and visibility). Delivery only is enough to serve a tool. See the [MCP tools reference](/docs/connect/tools-reference) for which tool needs which scope. ### Decide about OAuth Under **Connectors**, **Allow OAuth sign-in** is ticked by default. When you connect a tool by signing in, UI Rules uses your newest active key for that project that has this ticked, and makes a new one if you have none. It can only be turned on when the key is created, never added afterwards, so leave it ticked unless you are sure you will never sign a tool in with this key. The key is shown once, in full, on the screen that follows. Copy it before you close the dialog. It will not be shown again, and nothing in UI Rules can recover it. Your other keys keep working until you revoke them, so if you lose one, revoke it and create another. ## Rename a key The row menu has **Rename**. The name is the only thing a minted key lets you change: its permissions, its project, and its secret are fixed when it is created. A name has to be free within the key's own project, or within the brand for a brand-scoped key, so a name a live key there already holds is refused; revoked keys do not hold their names. ## Revoke a key The row menu has **Revoke API key**. Anything still using that key stops working straight away, whether that is an editor's MCP connection or your own API calls, and it cannot be undone. Create a new key to restore access. Revoking is what to do when a key has leaked, when a tool no longer needs your brand, or when someone who set a key up has left. Creating a new key does not affect the old ones, so revoking is the only thing that ends access. ## Related The endpoint, the key format, and every supported tool. Every tool a connected agent gets, and the scope each needs. Who changed what, including changes made by connected tools.