Skip to main content

​
MCP keys vs API keys

SureFeedback has two types of keys: MCP keys are regular API keys with token_type: mcp. They are project-scoped — all tools and resources automatically operate within your active project.

​
Creating a key

Go to Integrations → AI / MCP → Manage MCP Keys → Create MCP Key. Select one or more permissions:
For a read-only AI assistant, grant only Read. For an assistant that can update statuses and assign comments, add Write.

​
Passing the key

Pass your MCP key in the X-API-Key header on every request:
Authorization: Bearer sf_your_key_here also works.

​
Key lifecycle

  • Revoke — disables the key immediately without deleting it
  • Regenerate — issues a new secret; the old key stops working immediately
  • Delete — permanently removes the key
  • Expiry — optionally set an expiry date when creating a key

​
Security

  • Never commit MCP keys to source control
  • Use the minimum permissions needed
  • Regenerate keys if you suspect compromise
  • Set expiry dates for temporary integrations