API Keys

API keys authenticate requests to the RKT MCP server and REST API. Generate them in Settings > API Keys.

Creating a Key

1. Go to Settings > API Keys
2. Enter a name (e.g., "Claude Desktop", "Cursor", "Production")
3. Click Create key
4. Copy the key immediately — it's only shown once

Keys start with rkt_ and look like: rkt_a1b2c3d4e5f6...

Security

• Keys are hashed with SHA-256 before storage — we never store the raw key
• A prefix (rkt_abc123...) is stored for identification
• lastUsedAt is updated on each request for audit purposes
• Keys can be revoked instantly from the dashboard

Revoking a Key

Click the trash icon next to any key in the list. Revoked keys stop working immediately.

Auto-Disable

If a key is used with an MCP endpoint that fails 10 consecutive times, it is automatically disabled. Re-enable it from the dashboard after fixing the issue.

Usage

Pass the key as a Bearer token:

curl https://mcp.getrocketflow.io/api/mcp \
  -H "Authorization: Bearer rkt_your_key_here" \
  -H "Content-Type: application/json" \
  -d '...'

See MCP Server for connecting to Claude Desktop and Cursor.