API keys

Create, rotate, disable and revoke keys for the API, the CLI, and MCP clients.

An API key is org-scoped and carries full org access — it is not scoped to your own permissions. Treat it accordingly.

This is also where you get the key for connecting Claude Code or Cursor to mcp.smoo.ai.

How to

  1. 1

    Click Create API Key, name it, pick the key type and how long it lasts.

    M2M (Secret Key) is for servers, the CLI and MCP clients. B2M (Public Key) is for browser access and only works from the Allowed Origins you list. Keys last 90 days unless you pick another expiry (up to a year).

  2. 2

    Copy the key immediately.

    It is shown once.

  3. 3

    Use an M2M key as the Authorization header for mcp.smoo.ai, or with the API and SDKs.

  4. 4

    Use the ⋯ menu on a key to rename, disable, rotate or revoke it.

    Disable pauses a key and Enable turns it back on. Rotate gives a secret key a new secret and keeps the old one working for the overlap you choose (24 hours by default). Revoke retires a key for good.

  5. 5

    If a key may have leaked and you don’t know which, use Disable all keys.

    Every active key stops within about a minute. Your agents’ website chat widgets stay on unless you tick the option to disable them too. Re-enable brings back only the keys the kill switch turned off.

If something goes wrong

Requests 401 with an apparently correct key.
A trailing newline from a copy-paste or an echo pipe is the usual cause — the value is compared byte for byte. Also check the key’s status: a disabled, revoked or expired key is refused.
I can’t see API Keys.
Managing keys needs the Manage API keys permission (api_keys.manage). Org admins have it; an admin can add it to a custom role.

Related