Create & manage API keys

Create a key#

1. Open MCP & API → API keys for the correct site with administrator access.
2. Choose Create API key to open the dialog.
3. Give the service or agent a recognizable name.
4. Keep the default 30-day expiration or choose 7 days, 90 days, 6 months, 1 year, no expiration or a custom date in Weeveo's calendar.
5. Leave Allow changes unchecked for read-only access. Enable it only when this service should manage the site.
6. Create the key, then copy or download it from the one-time result.

Save it immediately#

The full secret is shown once. Later lists show masked metadata, permissions, expiry and usage; they cannot reveal the original secret. Only its hash is stored. If you lose the secret, delete the old key and create a replacement.

Use a bearer header#

Authorization: Bearer wv_live_your_key

Use the header over HTTPS. Keep the secret in your server's secret manager or protected environment, never in browser scripts, query parameters, a public repository or a shared screenshot. Keys remain bound to their site and issuing user's current access.

Expire or delete#

Access ends at the end of the chosen UTC expiration date. Delete a key to revoke it immediately; deleting a key does not erase analytics. Rotate by creating a replacement, updating the consumer, verifying it, and deleting the old key.

Agent administration#

create_api_key returns a secret once too. An API caller cannot manufacture write access from a read-only credential: allowWrite=true additionally requires existing write consent. See create_api_key, list_api_keys and delete_api_key.