Skip to content

API Keys

An API key lets a program sign in to your portal as a specific user, without a password. The most common use is connecting an AI assistant to the Portal MCP Server.

API keys are managed in the Admin Console under Access > API Keys. Only admins can see this page.

How a key signs in

A key always acts as the user it was created for, with exactly that user's permissions and group memberships. A key created for an admin can do anything that admin can do, so treat it like that admin's password.

API keys do not expire. A key keeps working until it is deleted.

The API keys list

Column What it shows
Name The name given when the key was created.
User The user the key signs in as.
Created When the key was created.

The key itself is never shown in the list. Portal stores only a one-way hash of each key, so a lost key cannot be recovered; delete it and create a new one.

Create an API key

  1. Click New API Key.
  2. In User, choose the user the key will sign in as. It defaults to you.
  3. In Name, enter a name that says what the key is for, such as Claude Code - laptop. The name is required and can be up to 255 characters.
  4. Click Create.
  5. Copy the key using the copy control next to API Key, and store it somewhere safe. It is shown only once.
  6. Click Done.

Delete an API key

  1. Open the ... menu on the key's row and click Delete.
  2. Click Delete to confirm.

Any program using the key stops being able to sign in. A request that is already signed in with the key may keep working for up to 30 seconds after the delete.

Create the first key from the command line

On a self-managed installation, you can also create a key from the server's shell. From the portal-docker-setup/setup directory:

./make.sh create_api_key --user <username> --name "<key name>"

The command prints only the key, so you can pipe it into another command. --name is optional and defaults to cli.