API keys

Create a key

1. Sign in and open Account.
2. Create the API account if your workspace is eligible and it does not exist yet.
3. Choose a name that identifies one agent or integration.
4. Choose only the scopes it needs and an expiry of 30, 90, 180, or 365 days. The default is 90 days.
5. Copy the full secret when it appears. AICD API does not show it again.

Choose scopes

• mcp:read allows the authenticated MCP route.
• civic:read allows health, change-feed, and batch reads.
• civic:export allows creation of a new snapshot and reads from that snapshot.
• A key cannot get a scope that its account does not have.

Store the key

The simple setup is to paste the key into your MCP client's secret or bearer-token setting. You can also use an environment variable or a secret store. 1Password is optional.

A client-held key can stay out of the model prompt and tool arguments. A local agent with broad computer access may still be able to read local settings or environment variables. Give that agent only the access you accept.

AICD_API_KEY=paste-your-key-here

Replace or revoke

1. For a planned move, create a new key with the same needed scopes.
2. Update the one agent that uses it.
3. Test the replacement without exposing it in logs.
4. Revoke the old key from Account.

• The Account page's Replace action revokes the selected key immediately and creates one replacement. Use it only when you can update the agent at once. A replacement key expires after 90 days.
• Revoke a key at once if it may have been exposed or the agent no longer needs access.
• A revoked or expired key returns 401 and cannot be restored.