API keys

Create read-only or read and write keys for AI assistants, the REST API and SDKs. Renew and revoke them.

5 stepsUpdated for AveeCare
In this guide
Open Settings and switch to the API Keys tabClick Generate New API Key and choose its accessCopy the key once from the Your API Key dialogConnect an AI assistant or your own programRenew or revoke a key

API Keys is the tab on Settings where you create keys that let AI assistants (through MCP) and your own programs and scripts (through the AveeCare REST API and SDKs) work with your AveeCare data. Each key inherits your role and permissions, can be limited to read-only access, expires on a date you choose, and can be revoked from its row at any time.

Quick answer

Open Settings and click the API Keys tab. Click Generate New API Key, give the key a label, choose Read-only or Read & write, pick an expiry, then click Generate Key. Copy the key from the dialog that follows; it is shown once. Use Revoke in the row to stop a key immediately.

Open Settings

What an API key can do

One key works in two places:

  • The REST API at https://api.aveecare.com/v1, used by the official SDKs for Node.js, Python, Rust, Go, Ruby, PHP, Java and .NET, the aveecare command-line tool, and any program that can make HTTPS requests. See the API reference.
  • The MCP endpoint at https://app.aveecare.com/api/mcp, used by AI assistants such as Claude Code, Codex, Cursor and Windsurf.

While a key is valid:

  • It has your role's permissions, and no more. A key can never see or change anything you could not in the app.
  • Its access level caps it further. A Read-only key can look things up but every request that would change data is refused. A Read & write key can also create, edit and delete.
  • No MFA prompt per request. The key replaces the interactive sign-in, so treat it like a password.
  • Logged. Every action the key takes is attributed to your account.
  • It expires. You choose 30, 60, 90 or 180 days when you create it.

Root Users see every key in the company on this tab. Regular Users only see their own keys.

1. Open Settings and switch to the API Keys tab

Open Settings

  1. Click Settings in the left sidebar, then click the API Keys tab.

    The tab strip scrolls sideways; API Keys is near the right end. You land on the list of keys with a blue Generate New API Key button in the top-right. The list shows Label, Key ID (the first characters only), User, Access, Created, Last Used, Expires, Status and Actions. Below the list, a Use your key panel shows the API address, a test command and SDK install commands.
    API Keys tab on the Settings page showing the keys list with an Access column, the Use your key panel underneath, and the Generate New API Key button outlined in a red box.

2. Click Generate New API Key and choose its access

  1. Click Generate New API Key and read the notice.

    The Security & Compliance Notice dialog lists what you are agreeing to: the key can be used by AI assistants and your own programs without MFA on each request, it inherits your role, you are responsible for keeping it secret, and every action is logged against your account.

  2. Type a label that says where the key will live.

    For example Claude Code - Work Laptop or Nightly visit export. Labels are the only way to tell keys apart on the list.

  3. Choose Read-only or Read & write under Access.

    Read-only is selected by default. It suits reports, dashboards and AI assistants that only answer questions. Choose Read & write only if the program or assistant needs to create, edit or delete records.
    Security and Compliance Notice dialog with a label typed in and the Access choice, Read-only selected and Read and write below it, outlined in a red box.

  4. Pick an expiry, then click Generate Key.

    Choose 30, 60, 90 (recommended) or 180 days. By generating the key you accept the terms in the notice.

3. Copy the key once from the Your API Key dialog

  1. Click Copy next to the key.

    The full key starts with ak_. An amber warning reminds you this is the only time it will be shown: AveeCare stores only a hash, so it cannot show it to you again.
    Your API Key dialog with the key, masked in this picture, outlined in a red box, the once-only warning, and the Use your key panel with REST API and SDKs examples that include the new key.

  2. Tick the confirmation box, then click Done.

    Done stays disabled until you tick I have copied and securely stored this key. The new key appears in the list with status Active.

4. Connect an AI assistant or your own program

The Use your key panel, both in the dialog and on the tab, has two tabs. Inside the dialog the examples already contain your new key; on the tab they show ak_... where your key goes.

  1. REST API & SDKs: for your own programs and scripts.

    It shows the base URL, a curl command that calls /v1/me to check the key works, and install commands for the Node.js, Python and Rust SDKs. Links go to the API documentation and the developer hub, which lists every SDK.

  2. AI assistants (MCP): for Claude Code, Codex, Cursor, Windsurf and others.

    Pick your assistant's tab and copy the command or config it shows. For Claude Code it is a single claude mcp add --transport http ... command to run in your terminal.
    AI assistants (MCP) tab in the Your API Key dialog, outlined in a red box, showing the Claude Code, Codex, Cursor, Windsurf and Generic tabs and the claude mcp add command with the key masked.

5. Renew or revoke a key

  1. Renew: replace a key before it expires.

    Click Renew on an Active key. The same dialog opens with the label filled in and the access level locked to the old key's. Generating creates a new key with a new value and revokes the old one, so update your program or assistant with the new key straight away. When a key is within 14 days of expiring, the Expires column says how many days are left.

  2. Revoke: stop a key immediately.

    Click Revoke on the row, then Revoke Key to confirm. Use the Label and Last Used columns to make sure it is the right key.
    API Keys list with Revoked and Active keys. The Revoke link on the Active row is outlined in a red box.

  3. The row changes to Revoked.

    The next request with that key is refused. A trash-can icon replaces Revoke so you can remove the row from the list. Revoked keys cannot be reactivated.

Common pitfalls

  • Closing the dialog before copying. The key is shown once. If you lose it, revoke it and generate a new one.
  • Giving write access that isn't needed. A reporting script or a question-answering assistant only needs Read-only. If a Read-only key is ever exposed, nobody can use it to change your data.
  • Sharing one key across devices or programs. Create a key per laptop, server or integration, so you can revoke one without breaking the others.
  • Forgetting that the key carries your role. A Root User Read & write key can do everything a Root User can. Create keys from the lowest-privilege user that has the access you need.
  • Letting a key expire. Expired keys stop working. Renew before the date in the Expires column.
  • Confusing this with AI settings. Turning off AI Features hides the in-app assistant but does not revoke API keys. Revoke the key itself to stop a program or assistant.

Frequently asked questions

No. AveeCare stores only a hash of the key, so it is shown exactly once, right after you generate it. If you lost a key, revoke it and generate a new one.
A Read-only key can look up anything your role can see, but every request that would create, change or delete data is refused. A Read & write key can also make changes, still limited to what your role is allowed to do. Keys created before access levels existed show as Read & write.
No. Renewing keeps the same access. To change it, generate a new key with the access you want, switch your program over, then revoke the old key.
Root Users see every key in the company. Regular Users see only the keys they created.
30, 60, 90 or 180 days, chosen when you create it. The Expires column shows the date. Click Renew before then to get a replacement key.
It stops working immediately: the next request using it is refused. The row changes to Revoked and cannot be reactivated.
Yes. Every action a key performs is attributed to the user who created it.
No. The AI Features setting only hides the in-app AI tools. Revoke the key on this tab to stop a program or assistant.
Written by
Calvin Nesvig
Founding Partner, AveeCare

Builds AveeCare full-time. The AveeCare Help Center is written and maintained by the team that builds the product, so the steps in every article come from the same people who ship the features.

All help articlesNeed a person?