API keys
Create secret keys for agents, scripts and servers, choose read or read and write, and revoke them.
An API key (dh_sk_…) lets agents, MCP clients, the CLI and scripts work with your project. It's a secret. Don't confuse it with the public project token that goes in your app:
Project token dh_… | API key dh_sk_… | |
|---|---|---|
| Used by | The SDK in your app | Agents, MCP, CLI, scripts |
| Can read your data | No | Yes |
| Safe in a browser | Yes | No |
Create a key
Settings → API keys & MCP. Enter a name, choose Read & write or Read only, and click Create key. Copy it right away: it's shown once. The panel then fills in the MCP setup with your new key.
- Name keys after the agent or job, such as
claude-growth-agentornightly-report. That name appears in the activity log next to everything the key changes. - A lost key can't be recovered. Create a new one and revoke the old one.
Read only vs read & write
| Read only | Read & write | |
|---|---|---|
| Run queries, read insights, dashboards, people, flags, experiments, feedback | ✓ | ✓ |
| Check what flags a user gets | ✓ | ✓ |
| Save insights and dashboards, create cohorts, flags and experiments, triage feedback, describe events, edit people | ✓ |
Over MCP, a read-only key doesn't see the tools that write.
No key can create or revoke API keys, rotate the project token, delete the project or create projects. Only signed-in people can, so an agent can't give itself more access.
One project per key. A key only works in the project it was created in.
Last used and revoking
The key list shows each key's name, access, when it was created and when it was last used (to the minute). Use it to find keys you no longer need.
Revoke removes a key. It stops working immediately, and what it did stays in the activity log.
Use a key
Send it as a bearer token:
curl -s https://app.datahop.dev/api/projects/1/query \
-H "Authorization: Bearer dh_sk_…" -H 'content-type: application/json' \
-d '{ "kind": "trends", "series": [{ "event": "signed_up" }], "interval": "week" }'