# Get an API key

> Create and revoke the workspace API keys (sk-octo_…) that authenticate the Platform API, the MCP server and the OpenAI-compatible API, from the dashboard Settings page.

Every integration — the OpenAI-compatible API, the MCP server, and the platform
REST API — authenticates with a workspace API key. You mint and manage keys
from the dashboard, no manual database step required.

## Create a key

1. Sign in to your workspace dashboard.
2. Go to **Settings → API Keys & Webhooks**.
3. Click **Create key**, optionally give it a name (e.g. "CI pipeline", "n8n
   workflow"), and confirm.
4. The full key is shown **exactly once**, in a reveal dialog — copy it now.

```text
sk-octo_5m1nJ8...redacted...9fQ
```

Once you close the dialog, the dashboard never shows the full key again — only
a masked prefix (`sk-octo_5m1n...`) in the list view, for identification. If you
lose a key, revoke it and create a new one.

## Creation limits

Key creation is rate-limited per workspace: at most **10 keys per rolling
hour**, and at most **25 active keys** at any time. Hitting either limit
returns `429` (`code: "rate_limited"`). Revoking a key immediately frees a
slot toward the active-key limit — prefer revoke-and-recreate over minting
extra keys.

The hourly limit's `429` includes a `Retry-After` header telling you exactly
when a slot frees. The active-key limit deliberately omits it: time does not
help, only revoking does.

The limit is shared by the whole workspace, but a non-admin can only see and
revoke their own keys. If you hit the active-key cap and your own list is
short, another member is holding the quota — ask an owner or admin.

## Revoke a key

From the same **API Keys** table, use the revoke action next to any key and
confirm. Revocation is immediate: any request using that key starts failing
with `401 invalid_api_key` right away.

## Who can see which keys

- Any workspace member can create their own key.
- A regular member sees and can revoke only **their own** keys.
- A workspace **owner or admin** sees **all** keys in the workspace (with the
  creator's name/email) and can revoke any of them.

## Keys carry your role

A key is not a separate, independently-scoped credential — it inherits the
**role of whoever created it** (`owner` / `admin` / `agent`) and is scoped to
their workspace. There's no separate "read-only" or "no-spend" key type yet.
See [Authentication](/getting-started/authentication/) for exactly what that
means for tool access and confirmations.

## Next step

With a key in hand:

- Make your first call: [OpenAI-compatible API overview](/openai-api/overview/)
- Or connect an MCP client: [MCP — Connect](/mcp/connect/). Claude Code and
  Codex can also sign in with your account and skip the key.