API keys

Create, rotate, and revoke the Project-bound keys that authenticate your servers and agents.

API keys authenticate servers and MCP clients. Each key starts with emitkit_ followed by 12 letters, belongs to one Organization, and is bound to one Project: the events it sends land in that Project. A key can create events, identify users, and erase identities for its Organization. Keys don’t expire.

Every member can see the Organization’s keys (by name and visible prefix). Only owners and admins can create, rotate, or revoke them.

Create a key

Open API keys

In the dashboard, open Settings → API keys.

Name it and pick the Project

Choose a recognizable name and the Project its events belong to.

Store the secret

The key is shown once. Copy it into a secret manager straight away. Don’t put it in a browser bundle, mobile app, URL, repository, log, or analytics property.

EmitKit stores only a hash of the key, so it can’t show it again. If you lose a key, rotate it.

Rotate or revoke

Rotate a key when an integration changes owners, the secret may have been exposed, or your policy requires it. Rotation creates a new key with the same name and Project and deletes the old one immediately, so update the integration right away. Idempotency keys used with the old key don’t carry over.

Revoke deletes the key immediately. Requests that use it get 401.

If a key’s Project is deleted, the key can’t create events (403) until the Project is restored. Deleted Projects are purged after 90 days, together with their keys.