API Keys
Open Settings → Integrations → API Keys to create and manage bearer keys for outbound integrations. Each key is scoped to the grants you select, and its secret is shown only once at creation time.
Only an admin or owner can create or revoke keys or change agent access.
The list
When keys exist, the table shows these columns:
Name — the label you gave the key
Key prefix — a short non-secret fragment, shown as
prefix…Grants — chips for the grants fixed at creation; overflow shows
+nCreated — when the key was created
Expires — a date, or Never
Status — Active, Revoked, or Expired
Active keys that you can manage show a Revoke action.
Create an API key
Click Create API Key. In the dialog:
Name — a label to identify this key (up to 120 characters)
Grants — choose what this key can do. Grants are fixed at creation and cannot be changed later. Labels include pairs such as Time entries: read, Tasks: write, Comments: read, and Billing: read. See Documentation → API → Authentication and Guides → Choosing grants for the full matrix.
Expiry — optional end date, or leave as Never (use Clear to remove a date)
Click Create Key. The API Key Created dialog shows the full key once. Copy it into your secret store, then click Done. You will not be able to see the full key again.
This is the only time the full key will be shown. Store it securely — you will not be able to see it again.
Revoke a key
Click Revoke on an active key. Confirm in Revoke API Key. Any integration using that key stops working immediately. Revoking also stops webhooks bound to that key.
Agent access
Above the key list, Agent access (MCP) lets you allow members' personal access keys to be used by agent integrations. Until this is enabled, personal access keys in this organization do not work. The switch shows Enabled or Disabled. Only an administrator or owner can change this setting.