Alchemist API & Automation

Alchemist: API Keys

Mint and manage tenant API keys for programmatic access to the Alchemist platform.

|View as Markdown
Hunter Hodnett
Hunter HodnettCPTO at Chipp
||1 min read
#alchemist#platform#api-keys

API keys authenticate programmatic access to the platform — the MCP server, CI scripts, or any direct HTTP call. A key is scoped to your tenant: it can act on your projects and tickets, and nothing else.

Create a key

Open the Alchemist tab and pick API Keys in the sidebar (under Platform; on a new project it sits behind More). You can also get there from a project’s Settings tab with the Create or view tenant Alchemist API key button.

Type a name (e.g. claude-code, ci) and click Create key. The full secret — alch_ followed by 64 hex characters — is shown once, with a Copy key button and a ready-to-paste Claude Code command. Copy it immediately; it is never displayed again. Treat it like a password.

Who can create keys:

  • Only a tenant owner or admin, signed in to the dashboard. Members get a “only a tenant owner or admin” message.
  • A key cannot create or revoke other keys. A leaked key therefore cannot mint its own replacement before you revoke it.
  • A tenant can hold up to 50 active keys. Revoke unused ones to make room.

alch_ keys are not the chipp_sk_ keys on Settings > MCP Access. The Alchemist API and MCP server accept only alch_ keys.

Use a key

Pass it as a bearer token on any /api/* request:

plaintext
curl https://build.chipp.ai/alchemist-api/api/jobs \
  -H "Authorization: Bearer alch_your_key_here"

The same key authenticates the MCP server at https://build.chipp.ai/alchemist-api/api/mcp for clients that send a bearer header (Claude Code, Claude Desktop, Cursor). Hosted connectors that only take a URL (claude.ai, ChatGPT) connect via OAuth instead and need no key — see the MCP server doc.

Revoke a key

On the same API Keys page, click Revoke on any key and confirm. Revocation takes effect immediately — the next request with that key is rejected. Revoking is a soft delete, so the key stays in the list (marked Revoked) and audit history never breaks. Create a replacement key before revoking one that something depends on. Only owners and admins can revoke.

Good hygiene

  • One key per consumer (per machine / per CI pipeline), so you can revoke a single leaked key without disrupting the others.
  • Keys are write-only at the API: no endpoint ever returns a key’s secret after creation, and the dashboard only ever shows the prefix.
  • Check Last used on the API Keys page. A key that says Never after a few weeks is a good candidate to revoke.