API keys

An API key is how an agent reaches netweft’s MCP server. Keys belong to the workspace, not to a person, and only owners and admins issue them.

Issue a key

On Settings, open API keys and fill in:

1. Name: up to 80 characters, such as Claude on my laptop, so you can tell keys apart later.
2. Scopes: what the key may read. A new key reads everything unless you narrow it.
3. Expires: never, in 30 days, in 90 days or in a year.

The key is shown once, in the form nw_<prefix>_<secret>. Copy it then: netweft stores only a hash of it and cannot show it again.

Scopes

Scope	What a key with it reads
Projects	Projects, their overviews and who the key belongs to
Site audit	Site audits, their issues and the pages they crawled
Keywords	Saved keywords and their tags
Rank tracking	Rank trackers, tracked keywords and their results
Context	Project context, competitors, key pages and backlinks
Billing	The workspace’s credit balance and subscription

Every MCP tool is read-only, so a scope decides what a key can see, never what it can change. Leave Billing off a key handed to an outside tool to keep the balance and plan private.

Revoke or delete a key

• Revoke key stops the key at once, and it cannot be un-revoked. Its record stays in the list for seven days so you can still identify it.
• Delete record forgets a revoked key’s record before the seven days are up.

Either way, the audit log keeps when the key was created, revoked and deleted, and by whom.

Limits

Requests made with one key are limited to 120 a minute. API keys work only on the MCP server; the dashboard’s own HTTP routes take a signed-in session instead. See HTTP API.