API keys

Create a key

1. Sign in and open Account.
2. Create the API account if your workspace is eligible and it does not exist yet.
3. Confirm the account has current paid data access. Creating or rotating a key needs a current paid plan period.
4. Choose a name that identifies one agent or integration.
5. Leave Export off unless that agent writes snapshots. The key itself needs no other choice: it carries both read scopes.
6. Choose a lifetime of 1 to 365 whole days, or no expiry where the plan allows it. Omit the lifetime to get the default of 90 days.
7. Copy the full secret when it appears. AICD API does not show it again.

Valid keys and the plan limit

• A valid key is one that is not revoked and has not expired. Each plan caps how many valid keys an account holds at once.
• Builder: 1 valid key at once, and a key may be issued with no expiry.
• Pro: 5 valid keys at once, and a key may be issued with no expiry.
• Ultra: 50 valid keys at once, and a key may be issued with no expiry.
• Every key on the account shares one usage pool, so a second key does not add allowance.
• Revoked and expired keys stay in the key list, and AICD API does not delete them for you.
• At the plan limit, creating another key is refused. Rotate a key instead: rotation revokes the live key and issues its replacement together, so the account stays inside the limit.

What a key can do

• One key serves both the records API and MCP, so there is no separate key type to choose. Every key carries the two read scopes together.
• The records API read scope allows health, change-feed, and batch reads. The MCP read scope allows the authenticated MCP route.
• Export is the only optional permission. It allows creation of a new snapshot and reads from that snapshot, it stays off unless you choose it, and it is a write permission: leave it off for a key that only reads.
• Reporting has no key permission at all: a valid key on an account with current paid access sends and checks reports over REST and from an MCP client. Submitting or checking a report takes no extra payment and does not use the plan allowance.
• A key cannot get a scope that its account does not have.

Store the key

The simple setup is to paste the key into your MCP client's secret or bearer-token setting. You can also use an environment variable or a secret store. 1Password is optional.

A client-held key can stay out of the model prompt and tool arguments. A local agent with broad computer access may still be able to read local settings or environment variables. Give that agent only the access you accept.

AICD_API_KEY=paste-your-key-here

Rotate or revoke

1. Rotate the key from Account. The replacement keeps the name and carries both read scopes, and the old secret stops working.
2. Put the new secret in the client, then test it without exposing it in logs.
3. Revoke the key when the agent no longer needs access.

• A plan that allows more valid keys can hold a fresh key beside the live one, so you can move the client over before you revoke the old key. At the plan limit, rotate instead: rotation replaces the live key in one step.
• The replacement takes the lifetime you choose, and the default is 90 days.
• Revoke a key at once if it may have been exposed or the agent no longer needs access.
• A revoked or expired key returns 401 and cannot be restored.