MicroApps

Appearance

API keys & automation ​

An API key is a reusable credential for scripts, servers, and assistants - anything that talks to MicroApps without a human logging in. Unlike a login token, a key does not expire; you revoke it when you are done with it.

The same key works for the REST API and for an MCP client such as Claude. Every click is named below.

Getting to the API keys tab ​

Keys live in Account Settings. It is the Settings entry in the side panel, under Account:

  1. Sign in to the console.
  2. Click Settings in the side panel, under Account. You land on Account Settings, on the Profile tab.
  3. Click the API keys tab. It is the sixth of seven: Profile, Notifications, Account, Team, Roles, API keys, Activity.

You land on the API Keys table, with columns Name, Key, Scope, Allowed IPs, Created and Last Used. If you have never made one, you get "No API keys yet" instead.

1. Create a key ​

  1. On the API keys tab, click New key, at the top right. The Create API key dialog opens.
  2. Type a Key name you will recognise in six months - deploy-ci, status-dashboard, claude-desktop.
  3. Optionally fill in Allowed IPs: a comma-separated list of IP addresses or CIDR ranges, such as 203.0.113.4, 10.0.0.0/8. The key then only works from there. Leave it empty and the key works from anywhere, which the table shows as Any.
  4. Choose a Scope:
    • Full access inherits your current permissions. Whatever you can do, the key can do.
    • Limited scope opens a permission grid underneath. Tick only what the job needs - View on Pods for a dashboard, Pods and Snapshots for a deploy script.
  5. Click Create Key. The dialog turns into API key created and shows the key, once, under the line "Copy your new key now - it will not be shown again". It starts with mck_.
  6. Click the copy button and put the key somewhere safe: a secret manager, or your CI's encrypted variables.
  7. Click Done.

Prefer Limited scope. A key can never exceed your own permissions, but "everything I can do" is rarely what a script needs, and with Limited scope selected, Create Key stays disabled until you have ticked at least one box.

You get exactly one look at it

We store a hash of the key, not the key. After you close that dialog, the Key column only ever shows the first twelve characters followed by an ellipsis, which is enough to tell your keys apart and no use to anyone else. Lose the real thing and there is no recovery - revoke it and create another.

What a key can never do ​

Team members, Roles and Account settings are missing from the permission grid on purpose. No API key may act on those three resources, however powerful the person who created it, and that includes the account Owner's keys. They stay interactive, signed-in actions.

A custom role can grant them to a person - see Team & roles. A key cannot hold them at all.

2. Call the REST API ​

Send the key as a bearer token - the same header the console uses:

bash
export MCK_KEY="mck_..."

curl https://cloud-api.microapps.io/api/pods \
  -H "Authorization: Bearer $MCK_KEY"

That lists your pods. Everything in the API reference works the same way; the key just needs the matching permission, or you get a 403.

bash
curl https://cloud-api.microapps.io/api/billing/stats \
  -H "Authorization: Bearer $MCK_KEY"

3. Connect an MCP client ​

The same key connects an assistant like Claude through MCP. In your client's MCP settings, add an HTTP server pointing at:

https://cloud-api.microapps.io/mcp

and set the authorization header to Bearer <your mck_ key>. The API keys tab shows the same URL in the blue note above the table, if you would rather copy it from there.

The assistant then sees the tools your key is allowed to use - give it a read-only key and it can report on your account but not change anything.

Least privilege

Make one key per job and scope each one tightly. If a key leaks, you revoke that one key and nothing else is affected.

4. Check what your keys are doing ​

The table on the API keys tab is the audit surface. Read it left to right:

  • Key is the visible prefix, mck_ plus eight characters, then an ellipsis.
  • Scope reads Full access, or a count like 3 permissions.
  • Allowed IPs reads the list you set, or Any.
  • Last Used shows how long ago, with the IP address it was last called from underneath. Never means nothing has ever used it.

That last column is the quickest way to find keys nobody needs any more. Revoke those.

Keys also belong to whoever created them. Disable that team member and their keys stop working; remove them and their keys are revoked outright.

5. Revoke a key ​

  1. Go to Account Settings (Settings in the side panel) and click the API keys tab.
  2. Find the key's row, matching on Name or on the prefix in the Key column.
  3. Click the Revoke key button in the actions column at the right-hand end of the row.
  4. Confirm Revoke in the Revoke API key dialog.

It stops working immediately, everywhere, for both the REST API and MCP. There is no undo and nothing to reinstate - anything that was using it needs a new key.

See also ​

Built for the long tail.

© 2026 MicroApps