> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcp-1.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Workspace-scoped credentials your MCP clients use to authenticate.

API keys are how an MCP client authenticates to the aggregated endpoint. Each key is scoped to a single workspace and grants access to every backend server and tool registered in it.

## Creating a key

Generate a key from the **API Keys** page. The full key value is shown exactly once at creation time — copy it before leaving the page. mcp1 stores only a hash, so a lost key can't be recovered and must be replaced with a new one.

## Using a key

```text theme={null}
Authorization: Bearer <your-api-key>
POST https://<api-host>/mcp
```

## Revoking a key

Revoke a key from the same page when it's no longer needed or may have leaked. Revocation is immediate — any client still presenting that key is rejected on its next call.

<Warning>
  Treat an API key like a password. Anyone holding it can call every tool exposed by the workspace's backend servers.
</Warning>