Skip to main content
API keys authenticate the Hikoo public REST API and the Hikoo MCP server. A key proves who you are so those interfaces can read the data you have access to.

​
How a key is scoped

A key is scoped to your user account. One key can reach every website in the workspaces you belong to, subject to each site’s subscription. This replaces the older per-website key model, so you no longer need a separate key for each site.
Access still follows subscriptions. A key can address a site only when that site has an active subscription.

​
Create a key

Open Settings, then the API keys section.
1

Name the key

Give it a descriptive name so you can tell your keys apart later.
2

Set an optional expiry

Add an expiry date if you want the key to stop working automatically, or leave it open.
3

Copy the key once

The full key is shown only once and starts with hk_. Copy it immediately and store it somewhere safe. If you lose it, create a new one.

​
Manage keys

From the API keys section you can list your keys and see their names and status. Revoke or delete a key to disable it immediately. Any client using that key stops working at once, so rotate before you revoke if a client still needs access.

​
Install cards

The API keys section also gives you two install cards:

Install the Hikoo MCP server

Get the steps to connect an AI client to your data.

Install the REST API

Get the steps to call the Hikoo REST API directly.

​
Keep keys safe

Treat keys like passwords. Never commit them to source control or paste them where others can read them. If a key leaks, rotate it: create a new key, update your clients, then revoke the old one.

Set up the MCP server

Wire a key into an AI client.

What the MCP can do

See the tools the MCP server exposes.

Settings

Where the API keys section lives.