API keys & automation

An API key is a reusable credential for scripts, servers, and assistants - anything that talks to MicroApps without a human logging in. Unlike a login token, a key does not expire; you revoke it when you are done with it.

The same key works for the REST API and for an MCP client such as Claude. Every click is named below.

Getting to the API keys tab

Sign in, click Settings in the side panel under Account, and click the API keys tab on Account Settings. It is the sixth of seven: Profile, Notifications, Account, Team, Roles, API keys, Activity.

You land on the API Keys table, with columns Name, Key, Scope, Allowed IPs, Created and Last Used. If you have never made one, you get "No API keys yet" instead.

1. Create a key

1. On the API keys tab, click New key, at the top right. The Create API key dialog opens.
2. Type a Key name you will recognise in six months - deploy-ci, status-dashboard, claude-desktop.
3. Optionally fill in Allowed IPs: a comma-separated list of IP addresses or CIDR ranges, such as 203.0.113.4, 10.0.0.0/8. The key then only works from there. Leave it empty and the key works from anywhere, which the table shows as Any.
4. Choose a Scope:
   • Full access inherits your current permissions. Whatever you can do, the key can do.
   • Limited scope opens a permission grid underneath. Tick only what the job needs.
5. Click Create Key. The dialog turns into API key created and shows the key, once, under the line "Copy your new key now - it will not be shown again". It starts with mck_.
6. Click the copy button and put the key somewhere safe: a secret manager, or your CI's encrypted variables.
7. Click Done.

Prefer Limited scope. A key can never exceed your own permissions, but "everything I can do" is rarely what a script needs, and with Limited scope selected, Create Key stays disabled until you have ticked at least one box. A starting point:

The job	Tick
A status dashboard	View on Pods, Monitoring, Billing
A deploy script	View, Create, Update on Pods; View, Create, Delete on Snapshots
A backup cron	View, Create, Delete on Backups
An AI assistant you are still trying out	View, and nothing else

You get exactly one look at it

We store a hash of the key, not the key. After you close that dialog, the Key column only ever shows the first twelve characters followed by an ellipsis, which is enough to tell your keys apart and no use to anyone else. Lose the real thing and there is no recovery - revoke it and create another.

What a key can never do

Team members, Roles and Account settings are missing from the permission grid on purpose. No API key may act on those three, however powerful the person who created it, the account Owner included. A custom role can grant them to a person - see Team & roles - but a key cannot hold them at all.

2. Call the REST API

Send the key as a bearer token - the same header the console uses. This one lists the account's keys, which is how a script audits them:

export MICROAPPS_API_KEY="mck_1a2b3c4d5e6f..."

curl https://cloud-api.microapps.io/api/api-keys/ \
  -H "Authorization: Bearer $MICROAPPS_API_KEY"

[
  {
    "id": "6a4d5b83b7006ccae6391810",
    "accountId": "6a4d5b83b7006ccae639100a",
    "userId": "6a4d5b83b7006ccae6391001",
    "name": "deploy-ci",
    "prefix": "mck_1a2b3c4d",
    "allowedIps": ["203.0.113.4"],
    "permissions": ["pods:read", "pods:create", "snapshots:create"],
    "lastUsedAt": "2026-09-16T08:41:03Z",
    "lastUsedIp": "203.0.113.4",
    "createdAt": "2026-09-01T12:00:00Z",
    "updatedAt": "2026-09-16T08:41:03Z"
  }
]

Every endpoint in the API reference works the same way. Two failures are worth recognising on sight:

{ "message": "You do not have permission to perform this action (pods:create)" }

A 403: the key's scope, or the permissions of whoever made it, does not cover the call.

{ "message": "This API key is not allowed from your IP address" }

Also a 403. The usual cause is an Allowed IPs list written for the machine you tested from rather than the one the job actually runs on - CI runners in particular do not keep a stable address.

3. Connect an MCP client

The same key connects an assistant like Claude through MCP. In your client's MCP settings, add an HTTP server pointing at:

https://cloud-api.microapps.io/mcp

and set the authorization header to Bearer <your mck_ key>. The API keys tab shows the same URL in the blue note above the table, if you would rather copy it from there.

The assistant then sees the tools your key is allowed to use - give it a read-only key and it can report on your account but not change anything.

Least privilege

Make one key per job and scope each one tightly. If a key leaks, you revoke that one key and nothing else is affected.

4. Check what your keys are doing

The table on the API keys tab is the audit surface. Read it left to right:

• Key is the visible prefix, mck_ plus eight characters, then an ellipsis.
• Scope reads Full access, or a count like 3 permissions.
• Allowed IPs reads the list you set, or Any.
• Last Used shows how long ago, with the IP address it was last called from underneath. Never means nothing has ever used it.

That last column is the quickest way to find keys nobody needs any more. Revoke those.

Keys also belong to whoever created them, and they inherit that person's access live: narrow their role and every key they made narrows with it. Disable the member and their keys stop working; remove them and their keys are revoked outright.

5. Revoke a key

1. Go to Account Settings (Settings in the side panel) and click the API keys tab.
2. Find the key's row, matching on Name or on the prefix in the Key column.
3. Click the Revoke key button in the actions column at the right-hand end of the row.
4. Confirm Revoke in the Revoke API key dialog.

It stops working immediately, everywhere, for both the REST API and MCP. There is no undo and nothing to reinstate - anything that was using it needs a new key.

See also

• API keys API
• Automation (MCP)
• API & automation
• Team & roles