> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attention.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, list, and revoke programmatic API keys.

API keys are the primary authentication mechanism for backend integrations and the Anthropic Messages API path. See [Authentication → For developers](/mcp/authentication#for-developers-api-keys-and-anthropic-messages-api) for the connection-side details.

These tools let you manage keys directly from an MCP session. The full token of a newly created key is shown **only once** — store it immediately.

## Tools

### list\_api\_keys

<Note>Scope: `mcp:read`. No parameters.</Note>

List API keys in your organization. Tokens themselves are not returned — only metadata (name, ID, scope, last-seen timestamp).

**Returns:** Markdown list of API keys with name, ID, scope (`org-level` / `user-level`), and last used date.

***

### create\_api\_key

<Warning>Scope: `mcp:write`. Requires admin role. The full token is returned only once — save it now.</Warning>

Create a new API key. Org-level keys have full org access; user-level keys are scoped to the authenticated user.

<ParamField query="name" type="string" required>
  Display name for the API key (e.g. `CRM Integration`, `CI/CD Pipeline`).
</ParamField>

<ParamField query="org_level" type="boolean">
  If `true` (default), creates an org-level key with full org access. If `false`, creates a user-level key scoped to the authenticated user.
</ParamField>

<ParamField query="expiry_hours" type="integer">
  Number of hours until the key expires. Omit for a non-expiring key.
</ParamField>

**Returns:** A confirmation containing the new key's ID, name, and **the full token** — shown only once. The result text includes a warning to save the token immediately.

***

### delete\_api\_key

<Warning>Scope: `mcp:write`. Requires admin role. Destructive — any integrations using this key will stop working immediately.</Warning>

Revoke an API key permanently. Use `list_api_keys` to find key IDs.

<ParamField query="api_key_id" type="string" required>
  The UUID of the API key to revoke.
</ParamField>