> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firsttouch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Public API Keys

> Create, rotate, and revoke your user-scoped Public API and MCP credentials.

Public API keys let server-side integrations authenticate FirstTouch Public API and compatible MCP requests without an interactive browser OAuth flow.

Open **Settings > MCP & API**, then find the **Public API keys** section.

<Note>
  The MCP & API tab follows the existing paid or free-trial MCP feature visibility. Every active team member can manage their own keys. You cannot see or change keys created by another user, regardless of your team or system role.
</Note>

Key management is unavailable during a system administrator's **login as user** session.

## Create A Key

<Steps>
  <Step title="Enter a descriptive name">
    Use a name that identifies the integration and environment, such as `Staging data sync` or `Production RevOps service`.
  </Step>

  <Step title="Create the key">
    Click **Create key**.
  </Step>

  <Step title="Save the secret">
    Copy the key to a trusted secrets manager. FirstTouch displays the plaintext value only once.
  </Step>

  <Step title="Acknowledge storage">
    Confirm that you saved the key, then close the dialog.
  </Step>
</Steps>

<Warning>
  FirstTouch cannot show the same secret again. If it is lost, rotate the key to generate a replacement.
</Warning>

## Review Keys

The page separates active and revoked keys. Each row can show:

* The key name.
* When it was created.
* When it was last used.
* When it was revoked, if applicable.

The secret itself is never shown in the list.

## Rotate A Key

Click **Rotate**, review the warning, and confirm. Rotation invalidates the previous secret immediately and displays a replacement once.

Update the consuming integration before its next request. Only the user who created the key can rotate it.

## Revoke A Key

Click **Revoke** and confirm to permanently block the credential. Revoked keys remain in history and cannot be used or rotated.

## Team And User Binding

A key always runs as you in the team where you created it, matching your MCP authorization identity. It stops working if it is revoked, rotated, or you lose access to that team. See [Public API Authentication](/api-reference/authentication) for the complete scope and security model.

## Use The Key

* For REST requests, send it through `X-API-Key`. See the [Public API Quickstart](/api-reference/quickstart).
* For MCP clients that support custom headers, configure the same `X-API-Key` header. See [Connect FirstTouch MCP](/WebApp/Mcp/connect).

Never use a Public API key in browser JavaScript or expose it to end users.