API keys are how an MCP client authenticates to the aggregated endpoint. Each key is scoped to a single workspace and grants access to every backend server and tool registered in it.
Creating a key
Generate a key from the API Keys page. The full key value is shown exactly once at creation time — copy it before leaving the page. mcp1 stores only a hash, so a lost key can’t be recovered and must be replaced with a new one.
Using a key
Revoking a key
Revoke a key from the same page when it’s no longer needed or may have leaked. Revocation is immediate — any client still presenting that key is rejected on its next call.
Treat an API key like a password. Anyone holding it can call every tool exposed by the workspace’s backend servers.