# Alchemist: API Keys

Mint and manage tenant API keys for programmatic access to the Alchemist platform.

---

API keys authenticate programmatic access to the platform -- the
[MCP server](/docs/guides/alchemist-mcp-server), CI scripts, or any direct HTTP call. A key
is scoped to your tenant: it can act on your projects and tickets, and
nothing else.

## Create a key

Go to **Settings → API keys** and click **Create key**. Give it a name
(e.g. `claude-code`, `ci`). The full secret -- `alch_` followed by 64 hex
characters -- is shown **once**, at creation. Copy it immediately; it is never
displayed again. Treat it like a password.

## Use a key

Pass it as a bearer token on any `/api/*` request:

```
curl https://build.chipp.ai/alchemist-api/api/jobs \
  -H "Authorization: Bearer alch_your_key_here"
```

The same key authenticates the MCP server at
`https://build.chipp.ai/alchemist-api/api/mcp` for clients that send a bearer header (Claude
Code, Claude Desktop, Cursor). Hosted connectors that only take a URL
(claude.ai, ChatGPT) connect via OAuth instead and need no key -- see the
[MCP server](/docs/guides/alchemist-mcp-server) doc.

## Revoke a key

From **Settings → API keys**, click **Revoke** on any key. Revocation takes
effect immediately -- the next request with that key is rejected. Revoking is
a soft delete, so it never breaks audit history. Create a replacement key
before revoking one that something depends on.

## Good hygiene

- One key per consumer (per machine / per CI pipeline), so you can revoke a
  single leaked key without disrupting the others.
- Keys are write-only at the API: no endpoint ever returns a key's secret
  after creation, and the dashboard only ever shows the prefix.