Skip to main content
Enoki’s MCP server and REST API authenticate with a workspace API key, passed as a Bearer token. Keys are prefixed egk_, scoped to one workspace, and shown in full only once.

​
Mint a key

Only workspace admins can create keys.
1

Open API key settings

Sign in at app.enokilabs.ai and go to Settings → API Keys.
2

Create a key

Click Create, give it a name, and select the scopes it needs (see below). The default selection is read + write.
3

Copy it once

The full key (egk_…) is shown once. Copy it and store it securely — you can’t retrieve it again, only rotate or revoke it. The dashboard afterwards shows just the egk_XXXX prefix for identification.

​
Scopes

A key carries one or more scopes. Grant the narrowest set that does the job. admin implies read, write, and test:run; read and write each imply their monitoring:* counterpart. But write does not imply read: the two are independent.

​
Which scope each MCP tool needs

Because write does not imply read, a create-only key can’t list_targets or read the setup guide. Mint read + write for the full setup flow, plus test:run to trigger assessments. Avoid admin keys for day-to-day use.
cancel_run sits under test:run rather than write: stopping a run is the same authority over the same resource as starting one, so a key that can trigger assessments can also stop them — and a key that can only trigger would otherwise be able to start work it could never halt.

​
Rotate and revoke

1

Rotate

Rotating issues a new key and keeps the old one valid for a grace period (default 24 hours) so you can swap it in without downtime, then the old key stops working. The new key is shown once, same as creation.
2

Revoke

Revoking disables a key immediately. Use it when a key is no longer needed or may be exposed.

​
Key hygiene

  • Least privilege. Grant only the scopes needed; never default to admin.
  • Keys live in config files. MCP clients store the key on disk (see Connect your agent), so treat it like any secret and prefer a scoped, rotatable key.
  • One key per use. Separate keys for separate consumers (a developer’s Claude Code vs a CI pipeline) so you can rotate one without disrupting the other.