# Manage API keys > Create, send, rotate, and delete API keys for scripts and agents, which expire after 90 days by default. Updated: 2026-11-09 An API key lets a script or an agent call Bonnard with no browser sign-in. It connects as the person who created it. ## Requirements - Any workspace role. ## Create a key 1. In the console at `app.bonnard.ai`, select **Settings**, then **API keys**. 2. Select **Create API key**. 3. Enter a **Name**, up to 120 characters. 4. Under **Scope**, select **All data sources** or one data source. A data source with tenancy reads `(customer key only)` and you cannot select it. 5. Under **Expires**, select **7 days**, **30 days**, **90 days**, **1 year**, or **No expiry**. The default is **90 days**. 6. Select **Create key**. 7. Copy the key. The console shows it one time. [Image: The Create API key dialog: Name, Scope set to All data sources, Expires set to 90 days, Cancel, and Create key] ## Send the key Send the key as a bearer token on each request to the connection URL. This request returns the tools the key can run: ```bash curl https://app.bonnard.ai/mcp \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' ``` A working key gets those tools in the response. ## What a key reaches An API key connects as its holder, so it reaches the data sources they can use. An API key runs the tools its holder gets. A key scoped to one data source reaches only that data source. If you remove that data source, **Scope** reads `Source removed`. A key from Settings is a personal key. It skips data sources with tenancy, because it has no tenant, the value that marks a customer's data. A customer key runs under its company's Tenant ID. ## Keys for customers A customer's user creates their own keys on **API keys** in the [customer portal](https://bonnard.ai/docs/customers/customer-portal.md), up to 20 for each user in each company. You cannot create a key for them. To remove one, you need the Editor role or higher. 1. In the console, select **Customers**, then the customer. 2. On the **Users** tab, open the menu at the end of the user's row. 3. Select **API keys**. 4. In the key's row, open the menu and select **Delete key**. 5. Select **Delete key** in the dialog. ## Make sure that the key works On **Settings**, **API keys**, the **Last used** column changes from Never after the first call. ## Troubleshooting ### `The API key is invalid or has been revoked.` The key is wrong or deleted, or its holder lost access. Copy the whole key, or create another. A holder who lost access first needs it back. ### `This API key can't be used at this address.` A key scoped to one data source works only at the connection URL. Send it to `https://app.bonnard.ai/mcp`. A key bound to an old app address works only at that address. Create another key. ### `This API key expired on .` The key passed its expiry date, or the window after a rotation ended. Create another key. ### ` keeps each customer's data separate. A personal API key can't query it.` The data source has tenancy. Use a customer key, or connect an AI client and use [Preview as](https://bonnard.ai/docs/access/preview-as.md). ## Rotate a key A rotated key gets the same name, scope, and expiry length. 1. On **Settings**, **API keys**, open the menu at the end of the key's row. 2. Select **Rotate key**. 3. Under **Current key keeps working for**, select **Stop now**, **1 hour**, **24 hours**, or **7 days**. The default is **24 hours**. 4. Select **Rotate key**. 5. Copy the replacement key. The console shows it one time. The old key stops at the end of the window, or at its own expiry if that is sooner. Rotating the replacement ends the old key's window immediately. A rotated key cannot be rotated again: rotate its replacement. A customer key bound to an old app address cannot be rotated: create another key. ## Rename or delete a key > [!WARNING] > Before you delete a key, stop what uses it, because the key stops working immediately. Each key that it replaced stops too. You cannot undo this. 1. On **Settings**, **API keys**, open the menu at the end of the key's row. 2. To rename the key, select **Rename**, enter the **Name** (up to 60 characters), and select **Save**. 3. To delete the key, select **Delete key**, then **Delete key** in the dialog. ## Related - [Connect your AI client](https://bonnard.ai/docs/ai-clients/connect-your-ai-client.md): sign in from an AI client with no key. - [OAuth](https://bonnard.ai/docs/developers/oauth.md): build a client that signs in through the browser.