Access keys

An access key acts as your account. Send it as a bearer token, to the MCP server (/mcp) or the web API (/v1):

Authorization: Bearer xor_…

Make a key

On your keys page, choose Make a key. You can limit it to one project, make it read-only, and give it a monthly spending cap.

The key is shown once. We keep only a hash, so copy it straight into your program’s environment.

Keep it safe

• Put it in XOR_KEY in your program’s environment, or in a .env file your version control ignores.
• Never put it in source code, and never paste it into a chat.
• Revoke it on the keys page as soon as you no longer need it, or if you think it leaked.

Keys your AI makes

An assistant can make a key for code it’s writing, with create (kind key). Those keys:

• work in one project,
• are capped at $5 a month unless a different cap is asked for, and never more than your monthly limit,
• can’t make keys themselves.

They show on your keys page with who made them, and you can change their caps or revoke them.

At the cap

A key at its monthly cap gets limit_reached on every metered call, reads included. Calls that cost nothing still work: my_stuff, status and account.

A read-only key can read, make GET and HEAD web requests that don’t save anything, email you with email_me, and make and manage keys, which come out read-only too. It can’t change anything else.

Each key, and each connected app, can make 600 tool calls a minute.

Connected apps

The apps you connected by signing in, such as Claude and ChatGPT, are listed on your keys page too, below your keys, with when each one connected.

Apps stay signed in while you use them. One you haven’t used for 90 days asks you to sign in again.

To stop an app using your account, choose Disconnect. It stops working within a minute. To use it again, connect it again and sign in.

Disconnecting an app doesn’t undo what it set up:

• Keys it made keep working until you revoke them. They’re listed with your keys, with the app that made them.
• Its schedules and background agents keep running. You’ll find those on your Stuff page.