The “API keys” screen in your account settings issues a key. It starts with vx_ and is shown once only — all we keep is a hash of it, so there is no screen to go back to and read it from.
The key travels in the x-api-key header and identifies you as the user. Every ownership check still applies: a key is a way in, not a way around.
The MCP server
The project ships an MCP server that lets an agent — Claude Code, Cursor, anything that speaks MCP — drive the system. It works against the same API the browser works against, not a second route into the database.
- list_apps — the projects this key owns, with the address and code of each
- create_app — a new, empty project
- build_app — a build or a change, from a free-text description
- get_app — the files, the tables with their permissions, the versions and the conversation
- read_records — reading records, as the owner
- list_templates — browsing the template catalogue
- use_template — copying a template into a new project
- search_skills — searching the Israeli knowledge library
Revoking a key stops everything using it immediately. A revoked key and a key that never existed get exactly the same answer.