MCP & Stores API Keys

API keys (prefix sk_) are long-lived credentials for the MCP server and the Stores API. Keys are scoped to a specific workspace and can be created, listed, and revoked through the API.

These sk_ keys are not accepted on the REST API (/api/v1). To call the REST API from a server or script, create a REST API key (rk_) instead.

Endpoints

The same endpoints manage both key types; pass ?type=rest_api to work with REST API keys, or omit it for MCP keys (the default).

Method	Path	Description
`GET`	`/api/v1/workspaces/{id}/api-keys`	List MCP keys (add `?type=rest_api` for REST API keys)
`POST`	`/api/v1/workspaces/{id}/api-keys`	Create a new API key
`DELETE`	`/api/v1/workspaces/{id}/api-keys/{keyId}`	Revoke an API key

List API Keys

GET /api/v1/workspaces/{id}/api-keys

Returns all API keys for the workspace. The raw key value is never returned in list responses — only the key_prefix is shown for identification.

Response


[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "workspace_id": "660e8400-e29b-41d4-a716-446655440000",
    "name": "CI/CD Pipeline Key",
    "type": "mcp",
    "key_prefix": "sk_abc12",
    "scopes": ["read:audience", "trigger:sync"],
    "created_by": "770e8400-e29b-41d4-a716-446655440000",
    "last_used_at": "2024-01-16T11:00:00Z",
    "expires_at": null,
    "created_at": "2024-01-15T09:30:00Z"
  }
]

Example


curl -X GET https://composable.zeotap.com/api/v1/workspaces/{id}/api-keys \
  -H "Authorization: Bearer <token>" \
  -H "X-Workspace-ID: <workspace-id>"

Create API Key

POST /api/v1/workspaces/{id}/api-keys

Creates a new API key for the workspace. The raw key value is returned only once in the creation response. Store it securely — it cannot be retrieved again.

Request Body

Field	Type	Required	Description
`name`	string	Yes	Display name for the API key
`scopes`	string[]	Yes	At least one scope. MCP keys use tool scopes (e.g. `read:audience`, `trigger:sync`)
`type`	string	No	`mcp` (default) or `rest_api`
`expires_at`	string	No	RFC3339 timestamp or `YYYY-MM-DD` date. Omit for a key that never expires


{
  "name": "CI/CD Pipeline Key",
  "scopes": ["read:audience", "trigger:sync"]
}

Response


{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "workspace_id": "660e8400-e29b-41d4-a716-446655440000",
  "name": "CI/CD Pipeline Key",
  "type": "mcp",
  "raw_key": "sk_abc123def456ghi789...",
  "key_prefix": "sk_abc12",
  "scopes": ["read:audience", "trigger:sync"],
  "created_by": "770e8400-e29b-41d4-a716-446655440000",
  "expires_at": null,
  "created_at": "2024-01-15T09:30:00Z"
}

The raw_key field is only returned in the creation response. Copy and store it securely immediately. If you lose the key, you must revoke it and create a new one.

Example


curl -X POST https://composable.zeotap.com/api/v1/workspaces/{id}/api-keys \
  -H "Authorization: Bearer <token>" \
  -H "X-Workspace-ID: <workspace-id>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CI/CD Pipeline Key",
    "scopes": ["read:audience", "trigger:sync"]
  }'

Revoke API Key

DELETE /api/v1/workspaces/{id}/api-keys/{keyId}

Permanently revokes an API key. Once revoked, any requests using this key will receive a 401 Unauthorized response. This action cannot be undone.

Path Parameters

Parameter	Type	Description
`id`	string (UUID)	Workspace ID
`keyId`	string (UUID)	API key ID to revoke

Response


{
  "status": "revoked"
}

Example


curl -X DELETE https://composable.zeotap.com/api/v1/workspaces/{id}/api-keys/{keyId} \
  -H "Authorization: Bearer <token>" \
  -H "X-Workspace-ID: <workspace-id>"

API Key Object

Field	Type	Description
`id`	string (UUID)	Unique identifier
`workspace_id`	string (UUID)	Workspace the key belongs to
`name`	string	Display name
`type`	string	`mcp` (sk_) or `rest_api` (rk_)
`raw_key`	string	Raw key value (only in creation response)
`key_prefix`	string	First few characters of the key for identification
`scopes`	string[]	Scopes granted to the key
`created_by`	string (UUID)	Account that created the key
`last_used_at`	string (ISO 8601) or null	When the key was last used
`expires_at`	string (ISO 8601) or null	Expiry timestamp, or null if it never expires
`created_at`	string (ISO 8601)	Creation timestamp

Best Practices

Name keys descriptively — Use names like “Production Sync Service” or “CI/CD Pipeline” so you can identify each key’s purpose.
One key per integration — Create separate keys for each system that needs API access. This makes it easy to revoke access for a single integration without affecting others.
Rotate regularly — Create a new key, update your integration, then revoke the old key.
Store securely — Use environment variables or a secrets manager. Never commit API keys to version control.