API keys

Automation surfaces — MCP, the CLI, and assistants that speak MCP — authenticate with a personal API key. Create and revoke keys under Settings → API keys without sharing your sign-in session.

Creating a personal key

Settings → API keys → give it a name → Create.

The key is displayed once. Copy it immediately — it is not recoverable afterwards, and losing it means creating a new one and revoking the old.

Name keys after where they live: cursor-laptop, claude-code, billing-script. When you later need to revoke one, the name is the only thing telling you which is which.

Requests carry it as an ordinary bearer token:

curl -X POST https://invoicey.app/api/mcp \
  -H "Authorization: Bearer YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

What a key grants

A personal key resolves to your user, and operates against your default workspace.

Switching workspaces in the sidebar updates that default so automation follows where you work. Settings → API keys also lets you set the default without changing the browser session — useful when you want MCP pointed at one workspace while you browse another.

Within that workspace it is full access. There are no scopes and no read-only variant: a holder can list invoices, create them, issue them, mark them paid, and email them to your clients.

Treat the key like a password: it can change financial records and send email to clients.

The one real containment: create_invoice injects the issuer from a server-side preset. A model cannot invent a bank account or IČO onto your invoice, regardless of what it is asked to do.

Revoking

Settings → API keys → Revoke. Immediate, and scoped to that one key — everything else keeps working.

Revoke whenever a key has been in a shared config file, a screenshot, or a chat you no longer trust. Key creation and revocation are both written to your security audit log under Settings → Security.

Related