Skip to main content
Last updated: February 16, 2026

​
What are API Keys?

API keys authenticate your AI coding agent with Detrics. When you register the Detrics MCP server with your agent, the API key is passed as an environment variable so the server can verify your identity and access your workspace data. Each API key is scoped to a workspace — it can only access data from the workspace where it was created.

​
Keeping Your API Keys Safe

Treat your API key like a password. Anyone with your key can access your workspace’s marketing data through the Detrics MCP server.
  • Never share keys publicly — don’t post them on GitHub, forums, Stack Overflow, or in screenshots
  • Never commit keys to version control — add them to .gitignore or use environment variables
  • Use environment variables, not hardcoded values, when referencing keys in scripts or configs
  • Revoke keys immediately if you suspect they’ve been exposed

​
Managing API Keys

You can manage your API keys from the Detrics web app at app.detrics.io/mcp/api-keys.

​
Generate a new key

  1. Go to any coding agent setup page or the API Keys page
  2. Click New Key
  3. Give the key a descriptive name (e.g., “Work laptop”, “CI server”)
  4. Copy the key immediately — it will only be shown once

​
Rename a key

  1. Open the API Keys page
  2. Click the menu icon next to the key
  3. Select Rename and enter a new name

​
Revoke a key

  1. Open the API Keys page
  2. Click the menu icon next to the key
  3. Select Revoke
  4. Confirm the revocation
Once revoked, the key stops working immediately. Any agent using that key will receive “Unauthorized” errors.

​
Key Scoping

API keys are scoped to the workspace where they were created. This means:
  • A key created in “Agency Workspace A” can only access data from that workspace
  • It cannot access data from “Agency Workspace B”, even if you’re a member of both
  • If you work across multiple workspaces, you’ll need a separate key for each one

​
If Your Key Is Compromised

If you believe your API key has been exposed:
  1. Revoke the key immediately from the API Keys page
  2. Generate a new key with a different name
  3. Update your coding agent with the new key by removing and re-adding the MCP server (see Setup Guide)
  4. Review your workspace activity for any unexpected usage