API keys
Create secret keys for agents, scripts and servers, choose read or read and write, and revoke them.
An API key (rc_sk_…) lets agents, MCP clients, the CLI and scripts work with your project. It's a secret. Don't confuse it with the public project token that goes in your game:
Project token rc_… | API key rc_sk_… | |
|---|---|---|
| Used by | The RoChart module in your game, web SDKs | Agents, MCP, CLI, scripts |
| Can read your data | No | Yes |
| Safe in a game or browser | Yes | No |
Create a key
Project settings → API keys & MCP → Create key. Enter a name, choose Read & write or Read only, and click Create key. Copy it right away: it's shown once. The page then fills in the MCP setup with your new key.
Revoking a key asks you to confirm, then cuts off everything using it immediately.
- Name keys after the agent or job, such as
claude-growth-agentornightly-report. That name appears in the activity log next to everything the key changes. - A lost key can't be recovered. Create a new one and revoke the old one.
Read only vs read & write
| Read only | Read & write | |
|---|---|---|
| Run queries, read insights, dashboards, people, flags, experiments, feedback | ✓ | ✓ |
| Check what flags a user gets | ✓ | ✓ |
| Save insights and dashboards, create cohorts, flags and experiments, triage feedback, describe events, edit people | ✓ |
Over MCP, a read-only key doesn't see the tools that write.
No key can create or revoke API keys, rotate the project token, delete the project or create projects. Only signed-in people can, so an agent can't give itself more access.
One project per key. A key only works in the project it was created in.
Last used and revoking
The key list shows each key's name, access, when it was created and when it was last used (to the minute). Use it to find keys you no longer need.
Revoke removes a key. It stops working immediately, and what it did stays in the activity log.
Use a key
Send it as a bearer token:
curl -s https://app.rochart.co/api/projects/1/query \
-H "Authorization: Bearer rc_sk_…" -H 'content-type: application/json' \
-d '{ "kind": "trends", "series": [{ "event": "$session_start", "math": "unique_persons" }], "interval": "day" }'