Creating and managing API keys
API keys let clients that do not use OAuth (Claude Code, Cursor, VS Code, Windsurf, JetBrains, n8n, Make, the CLI, and the REST API) authenticate with Crispy. If you only use Claude.ai, Claude Desktop, ChatGPT, or Codex, you can skip this entirely: those connect with OAuth and never need a key.
Creating a key
- Go to your dashboard and open API Keys.
- Create a new key.
- Copy it immediately. The raw key is shown exactly once and cannot be retrieved later.
Use it as a bearer token: the Authorization header is Bearer YOUR_API_KEY.
Scoped keys
You can hold up to 10 keys per account, and keys do not have to be all-powerful:
- Scope: 'team' (the default), 'workspace', or 'resource'.
- Permissions: a granular list like campaigns:read or inbox:write. Omit it for full access.
- Expiry: an optional number of days, handy for contractors or temporary tooling.
This all works from your MCP client too, via create_api_key, list_api_keys, and revoke_api_key. A least-privilege key per integration is the clean setup: your workflow automation does not need the same power as your main agent.
Rotating and revoking
Rotate by creating the new key first, updating your integrations, then revoking the old one. Revoking takes effect immediately: any terminal or integration using that key is signed out.
Common mistake: losing the key after creation and assuming you can view it again. You cannot. Just revoke it and create a fresh one, it takes seconds.
Pro tip: name your keys after what uses them ('n8n prod', 'laptop CLI'). Future you will know exactly which one is safe to revoke.