API keys

A personal API key lets a client act as your AI, with your private context. Send it on every request:

Authorization: Bearer uare_pk_...

Keys start with uare_pk_ followed by 32 hexadecimal characters. Today they work with your MCP server. The uare.ai Experts MCP server takes no key.

#Create a key

Keys live in your own Settings on uare.ai, so you, the AI's owner, create and revoke them.

1. Open Settings → API keys in uare.ai.
2. Select Generate new key and give it a name you'll recognize later, such as the client or the machine it's for.
3. Copy the key. It's shown only once.

#Store it safely

• Create one key per client or machine, so you can revoke one without breaking the others.
• Keep keys in an environment variable or your client's secret storage, not in files you commit.
• A key carries your private context. Don't share it, and don't put it in code that runs in a browser.
• Never use a key to answer other people, such as your website's visitors: your AI would answer them with your private context. Visitors get the website widget, the public API or, in assistants, the uare.ai Experts MCP server, which need no key and run in public mode.

#Revoke a key

In the same API keys list, revoke any key you no longer use or think was exposed. The next request with that key gets 403 and API key has been revoked. Generate a new key and update your client.

#What a key can do

Every key can call every tool of your MCP server for your AI. Keys have no scopes or expiry date yet, so revoking is how you limit one.