Go to /keys → Create key. Name it after the client you're connecting (e.g. "Claude Desktop" or "Local dev"). Rotate keys when people leave or a key may have leaked.
On creation, the full key is shown once. Copy it immediately — we only store a SHA-256 hash, so if you lose it you must revoke and create a new one.
Keys start with ct_live_. Treat them like passwords: never commit them, never paste them into shared chat, rotate them every few months or when a device is lost.
Revoking a key takes effect within one minute. The MCP server checks every call against the key's revoked_at column.