# Alchemist: API Keys

Mint and manage tenant API keys for programmatic access to the Alchemist platform.

---

API keys authenticate programmatic access to the platform: the [MCP server](/docs/guides/alchemist-mcp-server), CI scripts, or any direct HTTP call. A key is scoped to your tenant. It can act on your projects and tickets, and nothing else.

## Create a key

Go to **Settings** > **API keys** and click **Create key**. Give it a name (for example `claude-code`, `ci`). The full secret, `alch_` followed by 64 hex characters, is shown **once**, at creation. Copy it immediately. It is never displayed again. Treat it like a password.

## Use a key

Pass it as a bearer token on any `/api/*` request:

```bash
curl https://build.avcodex.com/alchemist-api/api/jobs \
  -H "Authorization: Bearer alch_your_key_here"
```

The same key authenticates the MCP server at `https://build.avcodex.com/alchemist-api/api/mcp` for clients that send a bearer header (Claude Code, Claude Desktop, Cursor). Hosted connectors that only take a URL (claude.ai, ChatGPT) connect via OAuth instead and need no key. See the [MCP server](/docs/guides/alchemist-mcp-server) doc.

## Revoke a key

From **Settings** > **API keys**, click **Revoke** on any key. Revocation takes effect immediately: the next request with that key is rejected. Revoking is a soft delete, so it never breaks audit history. Create a replacement key before revoking one that something depends on.

## Good hygiene

- One key per consumer (per machine, per CI pipeline), so you can revoke a single leaked key without disrupting the others.
- Keys are write-only at the API. No endpoint ever returns a key's secret after creation, and the dashboard only ever shows the prefix.
- If a tech leaves, revoke their keys the same day you disable their other access. A tenant-scoped key reaches every project you own.

*AVCodex · Your AV expertise. Amplified by AI.*