Issue a key for the application
In the tracker, open API keys and create a key with a recognizable label. Choose read for exports or write for supported mutations, then copy the token when it is issued. The complete lifecycle, including expiry and rotation, is covered in Manage API keys. The key-management routes are panel-only. An existing public API key cannot create a new key for itself.Send the token in a header
Store the token in an environment variable or your application’s secret store. Send it as a Bearer token:daily-report-export, a successful response has this shape:
keyId is an identifier for managing the key, not a replacement for the token in the header.
Choose read or write deliberately
A read key allows reads. A write key also allows the public create, update, archive, and restore operations documented in this reference. For example, a report exporter should keep read even if it runs every hour. Frequency does not require additional permission. A provisioning service that creates campaigns needs write, and should verify the returned entity IDs before using them in further writes. Requests act inside the key’s workspace. Supplying another workspace’s entity ID does not grant access to that entity. Public keys also do not unlock internal account, billing, or credential routes.Distinguish authentication from access
Do not replace a working key to solve a missing entity or invalid report filter. Run
whoami first to separate credential problems from endpoint problems.
For an uninterrupted planned replacement, create a second key, switch the application, verify it, then revoke the first. Rotate stops the old token immediately. If a credential is exposed, revoke it and issue a replacement.
Keep the token out of query strings, browser scripts, and application logs. The product MCP uses its own OAuth connection, so connecting Claude does not require sharing this token.