Tokens and API Keys
API tokens authenticate console APIs, CLI, SDK, MCP clients, and Relay IDE hooks. Each token has a name, expiry, and usage history.
Which key do I need?
| Key type | Scope | Use for |
|---|---|---|
Organization (eis_*) | Org platform access | Marshal SDK / CLI, AI Gateway, Tools & MCP clients |
| Personal with RELAY scope | Your user + Relay | Claude / Cursor / Codex / OpenCode hooks only |
Org keys are rejected on Relay IDE hooks. Personal Relay keys are the right choice for Connect. Full map: SDKs & CLI.
How To: Create a New API Token and Set Expiry
Create a new API token
- Open Account Settings → Tokens and API Keys.
- Enter a Token name that identifies usage (for example
local-relay,ci-marshal). - Choose scopes (include RELAY for IDE hooks) and an expiry (or No expiry if permitted).
- Click Create.
- Copy the secret immediately — it is shown only once.
Store the secret in a password manager or secret store. Never paste tokens into agent chat or commit them to git.
Token fields
| Field | Meaning |
|---|---|
| Name | Where the token is used |
| Expiry | When it stops working |
| Usage | Recent activity for audit |
Name examples:
local-relay
ci-marshal-sdk
mcp-cursorRevoke and rotate
Revoke compromised or unused tokens from the same table. Create a replacement before revoking production keys used by CI or shared MCP clients.
Related
- Relay getting started — personal Relay key
- Marshal getting started — org key + SDK
- SDKs & CLI
Last updated on