Skip to content
Dash
Get started for free Get started for free

Create API keys

API keys let you access Dash programmatically, without an open Slack, Teams, or web conversation. Use them for the REST API, the external MCP server (connecting Claude, ChatGPT, or other AI tools to Dash), or any headless integration.

How API keys work

Section titled “How API keys work”

A key belongs to the workspace, not a person. It carries scoped permissions (read, write, or admin) and is minted by an admin. The admin who created it is recorded, but the key itself acts on behalf of the workspace.

Dash never shows the full key after creation. Copy it immediately and store it securely.

Create a key

Section titled “Create a key”
  1. Go to app.dashpup.ai and open the API Keys page (under your workspace settings).
  2. Click New API key.
  3. Give it a name that describes its purpose (for example, “Claude MCP access” or “CI pipeline read-only”). Names can be up to 32 characters.
  4. Optionally, pick an expiry date. Leave it blank and the key never expires.
  5. Choose the scopes. You can tick more than one:
    • read — can query Dash, read data, search, but cannot create or modify anything.
    • write — can do everything read can, plus create and update (subject to the same approval flow as interactive use).
    • admin — full access, including workspace management operations.
  6. Click Create key. The key appears once. Copy it now.

Use a key

Section titled “Use a key”

Pass the key as a Bearer token in the Authorization header:

Authorization: Bearer dak_your_key_here

This works for the Dash REST API and the external MCP endpoint.

Revoke a key

Section titled “Revoke a key”

On the API Keys page, click the revoke button next to a key and confirm. The key stops working immediately and disappears from the list. Nothing is deleted — past activity is kept in the audit trail.

Best practices

Section titled “Best practices”
  • One key per integration. If your CI pipeline and your ChatGPT MCP connection both need access, create separate keys. That way revoking one doesn’t break the other.
  • Use the narrowest scope. A read-only integration should get a read key, not an admin key.
  • Rotate periodically. Create a new key, update the integration, then revoke the old one.
  • Never paste keys in Slack or Teams. Dash will refuse to store them in memory even if you try.

What’s next

Section titled “What’s next”