API keys

Creating a key

Keys are created in the organization's settings. The full secret is shown once, at creation time, and cannot be retrieved afterward, so you should store it in your secret manager right away. If a secret is lost or exposed, you should revoke the key and create a new one; revocation takes effect immediately.

API access is available on the plans that include it; see billing.

Abilities

Each key carries a set of abilities, and every API endpoint requires a specific one, named as resource:action pairs such as monitors:read or prompts:write. You should grant a key only the abilities its integration needs; a dashboard that reads analytics has no reason to hold write access to your monitors.

Some things cannot be granted to a key at all: deleting the organization, managing billing, and inviting or managing members are reserved for humans signed in to the app. The required ability for each endpoint is listed in the authentication section of the API reference.

Keys and organization context

A key belongs to exactly one organization and implies it, so requests made with a bearer token do not need to identify the organization separately. Endpoints that operate inside a project take the project via the Pineprompt-Project-Id header, as the API reference describes.

Next steps

The API reference documents every endpoint, and the MCP server guide covers connecting an AI agent to the same surface.