API & automation

Everything you can do in the console, you can do from code. The console is just a client for this same public API - what it does, you can do. Two ways in:

• REST API - plain HTTP and JSON. Good for scripts, servers, CI, dashboards, anything.
• MCP - the same account, driven by an assistant like Claude that speaks the Model Context Protocol.

Credentials

The REST API takes either of two bearer tokens:

• A login token (JWT), the same one the console uses. It expires an hour after you log in and there is no refresh endpoint, so it is fine for a quick interactive script and wrong for anything else.
• An API key (mck_...), created once and reused. This is the right choice for anything long-lived or unattended. You see the full token exactly once, at creation; after that only its mck_xxxxxxxx prefix.

MCP is API-key only. Assistants run without a human to log in, so a login token is not accepted there.

Scoped permissions

An API key does not have to be all-powerful. When you create one, you grant it a set of permissions - pods:read, snapshots:create, billing:read, or a whole resource with pods:* - and the key can do exactly those things and nothing else. A key for a status dashboard might only read; a key for a deploy script might manage pods but never touch billing.

The same scoping carries into MCP: an assistant only sees the tools its key is allowed to call. Give Claude a read-only key and it can look but not touch.

A key's effective power is its own scope, narrowed twice:

• By the API-key ceiling. No key may manage your team, roles, or account settings, no matter who created it. Those need a signed-in person: the Owner, or a member whose role grants them. An owner's key is capped the same way.
• By its creator, live. A key can never exceed the permissions of the person who made it, as they stand now - narrow that person's role and every key they made narrows with it. Disable them and their keys stop working on the next request.

Beyond permissions, keys inherit the account's limits and its credit floor, so a script cannot create a sixth pod or spend past an empty balance any more than you can.

IP binding

Optionally, pin a key to specific IP addresses or ranges. A request from anywhere else is refused with This API key is not allowed from your IP address, before it does anything. Handy for locking a key to your office, a CI runner, or a single server.

Where to next

• API keys - create, scope, and IP-bind a key
• Automation (MCP) - connect an assistant
• API overview - base URL, auth, pagination, errors
• API keys & automation guide - the practical walkthrough