--- title: "API Keys | Maeve Social" description: "Create a workspace-scoped API key, store it for automation, and replace or revoke it when needed." url: "https://maevesocial.com/guides/api-cli-and-mcp/api-keys" --- On this page 1. [Home](https://maevesocial.com/) 2. [Guides](https://maevesocial.com/guides) 3. [API, CLI and MCP](https://maevesocial.com/guides/api-cli-and-mcp) 4. API Keys # API Keys Updated September 12, 2026 Use an API key for scripts, servers, and scheduled jobs that run without browser sign-in. For an interactive terminal session, you can use [CLI browser login](https://maevesocial.com/guides/api-cli-and-mcp/the-command-line) instead. ## Create a Key 1. Open **Settings > Developer > API keys**. 2. Click **Create key**. 3. Enter a **Key name** that identifies the job, such as `Monthly client reports`. 4. Choose an expiration: **30 days**, **90 days**, **1 year**, or **No expiry**. 5. Select the workspaces the job needs. 6. Create the key. Settings, Developer, API keys Create API key Key name e.g. CI Bot, Zapier, n8n Expiration 30 days90 days1 yearNo expiry Workspace access 1 of 4 Brie PatisserieNorthside DentalHarbour GymMaeve Social CancelCreate key * 90 days is the default Leave it alone and the key stops working in three months. No expiry is the choice for anything that has to keep running. * One workspace is pre-ticked The one you are in. A key for one client's reporting job should carry that client and nothing else. * There is no edit later Name, expiry and workspaces are fixed once the key exists. Changing any of them means a new key. The create dialog. Expiration is a required choice with 90 days pre-selected, and the workspace you are standing in is already ticked, so both are worth changing on purpose rather than leaving as found. The default expiration is **90 days**, and the current workspace starts selected. Check both before creating the key. The name can contain up to 255 characters. | Your role | Workspaces you can grant | | --------------------------- | ---------------------------------- | | Organization Owner or Admin | Any workspace in that organization | | Workspace Manager | Workspaces you manage | ## Copy and Store the Key 1. Copy the key from the reveal dialog. 2. Store it in your password manager or automation service's secret storage. 3. Click **Done** after you have saved it. Key created Key created Copy your key nowThis is the only time the full key will be shown. Store it securely. You won't be able to see it again. Your API key ezb\_live\_4f9c2a17b83e5d06c1a94f2e7b3d8016a5c7e9f2d4b16803 Done Escape and clicking outside are both blocked while this is open. The key is on screen once. After Done, the list keeps the first 16 characters, when it was made, when it was last used and when it lapses, and nothing else. There is no way back to the rest of it. The full key is shown once Maeve stores a hash of the key. After you close the reveal dialog, the list shows only its prefix. If you lose the full key, create a replacement and revoke the old one. For CLI automation, configure your secret storage to provide the key as the `MAEVE_API_KEY` environment variable. For direct API requests, read the secret in your server code and send it in the `Authorization: Bearer` header. Keep the key out of source control, URLs, browser-side code, and chat messages. Entering a secret directly in a shell command can also save it in shell history. ## Check Workspace Access A key can access only its selected workspaces. It also depends on the access of the person who created it. A request outside its workspace grants returns a permission error even if that person can open the workspace in Maeve. Create separate keys for unrelated jobs so you can revoke one without stopping the others. Jobs sharing a key also share its rate limits. API keys cannot create, list, or revoke other API keys. Manage keys through your signed-in browser session in Settings. ## Replace a Key You cannot edit a key's name, expiration, or workspace grants after creation. To change them: 1. Create a new key with the settings you need. 2. Update the job's stored secret. 3. Check that the job works with the replacement. 4. Revoke the old key. There is a limit of ten unrevoked keys per organization. Expired keys still count toward that limit, so revoke keys you no longer use. ## If a Key Stops Working | Cause | What to do | | ----------------------------------------- | ---------------------------------------------------------------- | | The key expired | Create a replacement, update the job, and revoke the expired key | | The key was revoked | Create and configure a replacement if the job still needs access | | The creator lost required access | Have an eligible member create a replacement | | The workspace is outside the key's grants | Use a key that includes the intended workspace | Maeve checks the creator's access when the key is used. The key is revoked if they leave or are disabled in the organization, become a Finance user, or no longer manage every granted workspace without organization Admin or Owner access. Check automation when changing team access Automatic revocation does not send an email or in-app notification. Check jobs that use a person's keys before removing their access. A revoked key does not start working again if their permissions are restored. ## Revoke a Key 1. Open **Settings > Developer > API keys**. 2. Find the key and click its delete icon. 3. Confirm **Revoke key**. Revocation takes effect immediately and cannot be undone. Record the key's workspace grants first if you need them for an audit, because revocation clears those grants. ## Questions ### When should I use an API key instead of signing in? Use an API key for unattended scripts, servers, and scheduled jobs. Use CLI browser login for an interactive terminal session. ### Where do I create an API key? Open Settings > Developer > API keys and click Create key. ### Does a key expire? The default is 90 days. You can select 30 days, 90 days, 1 year, or No expiry when creating it. ### Can I see a key again after creating it? No. Copy and store it before clicking Done. If you lose it, create a replacement and revoke the old key. ### Can I rename a key or change its workspaces later? No. Create a replacement with the new settings, update your automation, and revoke the old key. ### What can a key reach? Only its granted workspaces, subject to the creator's permissions and the organization's plan. It cannot manage other API keys. ### What happens if the person who made a key leaves? The key is permanently revoked when it is used after the creator loses required access. Review their automation before changing team access. ### How many keys can we have? Ten unrevoked keys per organization. Expired keys count until you revoke them. ### Where should I store a key? Use a password manager or your automation service's secret storage. Supply it to the CLI through an environment variable such as MAEVE\_API\_KEY. ### Should several jobs share one key? Separate keys let you revoke one job without stopping the others. Jobs using the same key share its rate limits. ### Can I undo revoking a key? No. Create a new key if access is needed again. In Maeve Social * [REST API](https://maevesocial.com/features/api) * [CLI](https://maevesocial.com/features/cli) * [MCP Server](https://maevesocial.com/features/mcp)