zlicxzlicxDocs

API keys

An MCP client uses the same organisation API key as the REST API, so each key's permissions apply to both.

Creating a key

  1. In the console, go to Settings → API keys.
  2. Create a key, giving it only the permissions this client needs.
  3. Copy it and keep it in your password or secrets manager. It won't be shown again.

Sending the key

Send it with each request in the x-api-key header:

http
x-api-key: YOUR_ZLICX_API_KEY

For clients that can only send a bearer token, the server also accepts this form:

http
Authorization: Bearer YOUR_ZLICX_API_KEY

A console login cookie won't work here.

Rotating a key

  1. Create a replacement with the same or fewer permissions.
  2. Update each client that uses the old key, and check that it still connects.
  3. Revoke the old key once they've all moved.