Managing API Keys

Every account manages its keys from the Settings modal in the Studio. This page walks through the full lifecycle: creating a key, disabling it temporarily, and revoking it permanently.

Open the API Keys tab

Sign in to scenema.ai . Click your avatar in the top-right, choose Settings, then pick API Keys from the left rail.

The tab lists every key you have created against the currently active workspace, newest first, and includes an inline Create key action.

Create a key

Click Create key. A dialog opens with two inputs.

Name. A human label you use to identify the key later. Required, up to 80 characters. Good names name the client, environment, or purpose: MCP client — Claude Desktop, CI pipeline, local dev. Bad names are generic: key, test, new key.
Expiration. Optional. Pick a date up to ten years out or leave blank for a key that never expires. Rotation-oriented workflows benefit from a fixed expiry so keys age out on their own.

Click Create. The dialog swaps to a one-time reveal panel showing the full plaintext key.

This is the only time you will see the full key. Copy it now and store it somewhere durable, such as a password manager, .env file that is git-ignored, or your CI provider’s secret store. Once you close the panel, Scenema shows only the short prefix.

Click Done. The tab refreshes and the new key appears in the list with its short prefix (sk_abcd…), the label you set, the creation date, the current rate limit, and its enabled state.

Disable a key

Disabling a key stops it from authenticating any request without deleting the row. Use it when a client is suspected of leaking a key but you want to verify before rotating, or when you want to pause a scheduled job that runs against a key.

Locate the key in the list. Click the toggle labeled Enabled on the row.

The change is immediate. The row’s badge flips to Disabled, and any request made with the plaintext key returns 401 Unauthorized: Authentication failed within seconds. Requests that were already in flight when you toggled complete normally; new requests are blocked.

To re-enable, click the toggle again. The key resumes authenticating without any regeneration. The plaintext value never changes across an enable-disable cycle.

Revoke a key

Revoking permanently deletes the row. The plaintext key stops working immediately and cannot be restored. Use revoke when a key is confirmed compromised, when a client has been decommissioned, or when you no longer need the identifier for audit purposes.

Locate the key in the list. Click the trash icon on the row. A confirmation prompt appears.

Click Revoke to confirm. The row disappears from the list and any request against that key returns 401.

Revoke and disable serve different purposes. Revoke is permanent and destructive. Disable is reversible and preserves the key’s ID + audit history. Prefer disable while you investigate; reserve revoke for confirmed compromise or decommissioning.

What each row shows

Every row in the list carries:

Name. The label you set at creation.
Prefix. The first six characters of the key (sk_abcd) followed by an ellipsis. Enough to identify the key visually without exposing the secret.
Created. ISO timestamp of creation.
Last used. ISO timestamp of the most recent successful authentication, or “Never used” if the key has not been called yet.
Request count. Total successful authentications since creation.
Rate limit. Current per-minute ceiling. Set from the workspace’s plan at creation and updated server-side on any plan change.
Enabled toggle. Live state; flipping it stops or resumes authentication immediately.
Revoke action. Permanent delete with confirmation.

Multiple keys per user

You can hold as many keys as you like, on any plan. Nothing about Scenema’s cost or performance changes with more keys. Common patterns:

One key per environment: local, staging, prod.
One key per client integration: mcp-claude, mcp-chatgpt, github-actions.
One key per scheduled job so you can revoke one without disturbing the others.