API keys
Authenticate personal automation without exposing your sign-in session.
Automation surfaces — MCP, the CLI, and assistants that speak MCP — authenticate with a personal API key. Create and revoke keys under Workspace → API keys without sharing your sign-in session.
Creating a personal key
Open Workspace → API keys, give the key a name and choose Create.
The key is displayed once. Copy it immediately — it is not recoverable afterwards, and losing it means creating a new one and revoking the old.
Name keys after where they live: cursor-laptop, claude-code, billing-script. When you later
need to revoke one, the name is the only thing telling you which is which.
Requests carry it as an ordinary bearer token:
curl -X POST https://invoicey.app/api/mcp \
-H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'What a key grants
A personal key resolves to your user, and operates against your default workspace.
Switching workspaces in the sidebar updates that default so automation follows where you work. Workspace → API keys also lets you set the default without changing the browser session — useful when you want MCP pointed at one workspace while you browse another.
Personal keys have read and write capability rather than selectable per-key scopes. They remain limited by your current workspace membership, role permissions and plan. Within those permissions, a holder can read invoices, create drafts, issue them, record payment and send email to clients. OAuth connections additionally use the scopes approved during connection.
Treat the key like a password: it can change financial records and send email to clients.
A key is not limited to the workspace you are looking at
It binds to your default workspace, not whichever one your browser session currently has active. If those differ, the API keys settings page shows both. Switching in the sidebar keeps them aligned.
For invoice creation, the seller comes from the connected workspace's issuer setup, not an issuer preset selected by the assistant. Review the actual seller and invoice facts before issuing.
Revoking
Open Workspace → API keys and choose Revoke. Immediate, and scoped to that one key — everything else keeps working.
Revoke whenever a key has been in a shared config file, a screenshot, or a chat you no longer trust. Key creation and revocation are both written to your security audit log under Settings → Security.