# API keys

> Create, store and revoke the personal API keys that let MCP clients use your AI through your MCP server.

A personal API key lets a client act as your AI, with your private context. Send it on every request:

```http
Authorization: Bearer uare_pk_...
```

Keys start with `uare_pk_` followed by 32 hexadecimal characters. Today they work with [your MCP server](/docs/mcp/quickstart). The [uare.ai Experts MCP server](/docs/mcp/experts) takes no key.

## Create a key

Keys live in your own Settings on uare.ai, so you, the AI's owner, create and revoke them.

1. Open [Settings → API keys](https://app.uare.ai/chat-with-me?settings=api-keys) in uare.ai.
2. Select **Generate new key** and give it a name you'll recognize later, such as the client or the machine it's for.
3. Copy the key. It's shown only once.

## Store it safely

- Create one key per client or machine, so you can revoke one without breaking the others.
- Keep keys in an environment variable or your client's secret storage, not in files you commit.
- A key carries your private context. Don't share it, and don't put it in code that runs in a browser.
- Never use a key to answer other people, such as your website's visitors: your AI would answer them with your private context. Visitors get the [website widget](/docs/website/quickstart), the [public API](/docs/api/build-your-own) or, in assistants, the [uare.ai Experts MCP server](/docs/mcp/experts), which need no key and run in public mode.

## Revoke a key

In the same **API keys** list, revoke any key you no longer use or think was exposed. The next request with that key gets `403` and `API key has been revoked`. Generate a new key and update your client.

## What a key can do

Every key can call every [tool of your MCP server](/docs/mcp/tools) for your AI. Keys have no scopes or expiry date yet, so revoking is how you limit one.