Alchemist: API Keys
Mint and manage tenant API keys for programmatic access to the Alchemist platform.
API keys authenticate programmatic access to the platform — the MCP server, CI scripts, or any direct HTTP call. A key is scoped to your tenant: it can act on your projects and tickets, and nothing else.
Create a key
Go to Settings → API keys and click Create key. Give it a name
(e.g. claude-code, ci). The full secret — alch_ followed by 64 hex
characters — is shown once, at creation. Copy it immediately; it is never
displayed again. Treat it like a password.
Use a key
Pass it as a bearer token on any /api/* request:
curl https://build.chipp.ai/alchemist-api/api/jobs \
-H "Authorization: Bearer alch_your_key_here"The same key authenticates the MCP server at
https://build.chipp.ai/alchemist-api/api/mcp for clients that send a bearer header (Claude
Code, Claude Desktop, Cursor). Hosted connectors that only take a URL
(claude.ai, ChatGPT) connect via OAuth instead and need no key — see the
MCP server doc.
Revoke a key
From Settings → API keys, click Revoke on any key. Revocation takes effect immediately — the next request with that key is rejected. Revoking is a soft delete, so it never breaks audit history. Create a replacement key before revoking one that something depends on.
Good hygiene
- One key per consumer (per machine / per CI pipeline), so you can revoke a single leaked key without disrupting the others.
- Keys are write-only at the API: no endpoint ever returns a key’s secret after creation, and the dashboard only ever shows the prefix.