Skip to main content
An API key authenticates every request. Keys look like re_.... Each key has a scope that limits what it can do, so give each service its own key with the smallest scope it needs.

​
Scopes

A request with a valid key that lacks the scope for the action returns 403.

​
Create a key

Create a key in the dashboard. The key is shown once. SendFlit stores only a SHA-256 hash, so a lost key can’t be recovered. Create a new one instead.

​
Rotate a key

1

Create a replacement

Create a new key with the same scope in the dashboard.
2

Deploy it

Update your secret store and roll out the new key.
3

Revoke the old key

Revocation takes effect immediately, so make sure nothing still uses the old key.

​
Store keys safely

  • Keep keys in environment variables or a secrets manager.
  • Never put keys in source code, client-side code, mobile apps, or logs.
  • Use separate keys for each environment, such as staging and production.

​
Agent keys

Keys used by AI agents can also have limits, and the dashboard can require approval for certain actions. An agent can’t do more through the MCP server than its key can do over HTTP.