Skip to main content
Enoki’s REST API authenticates with a workspace API key, passed as a Bearer token, and so can the MCP server. Keys are prefixed egk_, scoped to one workspace, and shown in full only once. An app can also sign in to the MCP server instead of using a key; see Connect your agent.

​
Mint a key

Only workspace admins can create keys.
1

Open API key settings

Sign in at app.enokilabs.ai and go to Settings → API Keys.
2

Create a key

Click Create, give it a name, and select the scopes it needs (see below). The default selection is read + write.
3

Copy it once

The full key (egk_…) is shown once. Copy it and store it securely — you can’t retrieve it again, only rotate or revoke it. The dashboard afterwards shows just the egk_XXXX prefix for identification.

​
Scopes

A key carries one or more scopes. Grant the narrowest set that does the job. admin implies read, write, and test:run; read and write each imply their monitoring:* counterpart. But write does not imply read: the two are independent.

​
Which scope each MCP tool needs

Because write does not imply read, a create-only key can’t list_targets or read the setup guide. Mint read + write for the full setup flow, plus test:run to trigger assessments. Avoid admin keys for day-to-day use.
cancel_run sits under test:run rather than write: stopping a run is the same authority over the same resource as starting one, so a key that can trigger assessments can also stop them — and a key that can only trigger would otherwise be able to start work it could never halt.
An app that signed in holds the same scopes, and the same table applies to it. It always has read, and has write and test:run when they stayed ticked as it connected. Change them under Settings → Connected apps.

​
Rotate and revoke

1

Rotate

Rotating issues a new key and keeps the old one valid for a grace period (default 24 hours) so you can swap it in without downtime, then the old key stops working. The new key is shown once, same as creation.
2

Revoke

Revoking disables a key immediately. Use it when a key is no longer needed or may be exposed.

​
Key hygiene

  • Least privilege. Grant only the scopes needed; never default to admin.
  • Keys live in config files. MCP clients store the key on disk (see Connect your agent), so treat it like any secret and prefer a scoped, rotatable key. Where your client can sign in instead, its access is what you allowed, ends on its own, and can be ended under Settings → Connected apps.
  • One key per use. Separate keys for separate consumers (a developer’s Claude Code vs a CI pipeline) so you can rotate one without disrupting the other.