Skip to main content
Public API keys let server-side integrations authenticate FirstTouch Public API and compatible MCP requests without an interactive browser OAuth flow. Open Settings > MCP & API, then find the Public API keys section.
The MCP & API tab follows the existing paid or free-trial MCP feature visibility. Every active team member can manage their own keys. You cannot see or change keys created by another user, regardless of your team or system role.
Key management is unavailable during a system administrator’s login as user session.

​
Create A Key

1

Enter a descriptive name

Use a name that identifies the integration and environment, such as Staging data sync or Production RevOps service.
2

Create the key

Click Create key.
3

Save the secret

Copy the key to a trusted secrets manager. FirstTouch displays the plaintext value only once.
4

Acknowledge storage

Confirm that you saved the key, then close the dialog.
FirstTouch cannot show the same secret again. If it is lost, rotate the key to generate a replacement.

​
Review Keys

The page separates active and revoked keys. Each row can show:
  • The key name.
  • When it was created.
  • When it was last used.
  • When it was revoked, if applicable.
The secret itself is never shown in the list.

​
Rotate A Key

Click Rotate, review the warning, and confirm. Rotation invalidates the previous secret immediately and displays a replacement once. Update the consuming integration before its next request. Only the user who created the key can rotate it.

​
Revoke A Key

Click Revoke and confirm to permanently block the credential. Revoked keys remain in history and cannot be used or rotated.

​
Team And User Binding

A key always runs as you in the team where you created it, matching your MCP authorization identity. It stops working if it is revoked, rotated, or you lose access to that team. See Public API Authentication for the complete scope and security model.

​
Use The Key

Never use a Public API key in browser JavaScript or expose it to end users.