# API keys

> Issue a workspace API key for netweft's MCP server, narrow what it can read with scopes, set an expiry, and revoke or delete it.

Source: https://netweft.com/docs/api-keys
Updated: 2026-10-15

**An API key lets an agent read a workspace through the MCP server. Keys belong to the workspace, are shown once, read only what their scopes allow, and can never change data or spend credits.**

An API key is how an agent reaches netweft's [MCP server](/docs/mcp-server).
Keys belong to the workspace, not to a person, and only owners and admins
issue them.

## Issue a key

On **Settings**, open **API keys** and fill in:

1. **Name**: up to 80 characters, such as `Claude on my laptop`, so you can
   tell keys apart later.
2. **Scopes**: what the key may read. A new key reads everything unless you
   narrow it.
3. **Expires**: never, in 30 days, in 90 days or in a year.

The key is shown once, in the form `nw_<prefix>_<secret>`. Copy it then:
netweft stores only a hash of it and cannot show it again.

## Scopes

| Scope | What a key with it reads |
| --- | --- |
| Projects | Projects, their overviews and who the key belongs to |
| Site audit | Site audits, their issues and the pages they crawled |
| Keywords | Saved keywords and their tags |
| Rank tracking | Rank trackers, tracked keywords and their results |
| Context | Project context, competitors, key pages and backlinks |
| Billing | The workspace's credit balance and subscription |

Every MCP tool is read-only, so a scope decides what a key can see, never what
it can change. Leave **Billing** off a key handed to an outside tool to keep
the balance and plan private.

## Revoke or delete a key

- **Revoke key** stops the key at once, and it cannot be un-revoked. Its
  record stays in the list for seven days so you can still identify it.
- **Delete record** forgets a revoked key's record before the seven days are
  up.

Either way, the [audit log](/docs/team-and-roles) keeps when the key was
created, revoked and deleted, and by whom.

## Limits

Requests made with one key are limited to 120 a minute. API keys
work only on the MCP server; the dashboard's own HTTP routes take a signed-in
session instead. See [HTTP API](/docs/http-api).