# API keys (/docs/agents/api-keys)

An API key (`dh_sk_…`) lets agents, MCP clients, the CLI and scripts work with your project. It's a **secret**. Don't confuse it with the public project token that goes in your app:

| | Project token `dh_…` | API key `dh_sk_…` |
| --- | --- | --- |
| Used by | The SDK in your app | Agents, MCP, CLI, scripts |
| Can read your data | No | Yes |
| Safe in a browser | Yes | **No** |

## Create a key [#create-a-key]

**Settings → API keys & MCP.** Enter a name, choose **Read & write** or **Read only**, and click **Create key**. Copy it right away: it's shown **once**. The panel then fills in the MCP setup with your new key.

- **Name keys after the agent or job**, such as `claude-growth-agent` or `nightly-report`. That name appears in the activity log next to everything the key changes.
- A lost key can't be recovered. Create a new one and revoke the old one.

## Read only vs read & write [#read-only-vs-read--write]

| | Read only | Read & write |
| --- | --- | --- |
| Run queries, read insights, dashboards, people, flags, experiments, feedback | ✓ | ✓ |
| Check what flags a user gets | ✓ | ✓ |
| Save insights and dashboards, create cohorts, flags and experiments, triage feedback, describe events, edit people | | ✓ |

Over MCP, a read-only key doesn't see the tools that write.

**No key can** create or revoke API keys, rotate the project token, delete the project or create projects. Only signed-in people can, so an agent can't give itself more access.

**One project per key.** A key only works in the project it was created in.

## Last used and revoking [#last-used-and-revoking]

The key list shows each key's name, access, when it was created and when it was **last used** (to the minute). Use it to find keys you no longer need.

**Revoke** removes a key. It stops working immediately, and what it did stays in the activity log.

## Use a key [#use-a-key]

Send it as a bearer token:

```bash
curl -s https://app.datahop.dev/api/projects/1/query \
  -H "Authorization: Bearer dh_sk_…" -H 'content-type: application/json' \
  -d '{ "kind": "trends", "series": [{ "event": "signed_up" }], "interval": "week" }'
```

See [MCP](/docs/agents/mcp), [CLI](/docs/agents/cli) or the [REST API](/docs/reference/rest-api).