API keys
One key mechanism authenticates the REST API, the MCP server, and Zapier. Here is how to create one, what it can do, and how revoking it works.
Updated 2026-10-11
An API key is how anything outside your browser session — a script, Zapier, an AI assistant — proves it's allowed to act on your workspace. NeoKivo has one key mechanism; the REST API, the MCP server, and Zapier all use it.
Create a key
- 1Open Settings → API & webhooks. Any workspace member can create a key.
- 2Name the key and create it. The Zapier and AI assistants (MCP) cards on the same page create their own keys the same way, with a matching name.
- 3Copy the key. It starts with nk_live_ and is shown only once.
The key is shown once and stored only as a SHA-256 hash — NeoKivo cannot show it again. If you lose it, revoke it and create a new one.
What a key can do
A key acts as the workspace member who created it — same role permissions, same deal visibility and financial masking, as if that person were using the app themselves. If its creator can't create deals, neither can their key. If a deal is private to someone else, the key can't see or touch it either.
If a key's creator later leaves the workspace — or on an old key with no recorded creator — the key stops working on every request, reads included. NeoKivo does not fall back to full workspace access: it fails closed with a 403 and the message "This API key cannot act: its creator is no longer a member of this workspace. Create a new API key." The fix is the same either way — create a new key as a current member.
The same orphan rule applies to the MCP server, which authenticates with these keys too. For the REST API, writes are also blocked separately, with a 402, when the workspace itself is read-only (not yet activated) — that check runs after the orphan check, so an orphaned key always gets the 403, never a misleading 402. For the MCP server, a read-only workspace instead refuses writes at the tool-call level — the tool returns a refusal, not an HTTP 402.
Revoking a key
In Settings → API & webhooks, you can revoke your own keys from the list, and the workspace owner sees every key with its creator and can revoke any of them. Revoking is immediate — the next request with that key gets a 401 with "Invalid API key," whether it comes from a script, Zapier, or an MCP client.
| Detail | Value |
|---|---|
| Prefix | nk_live_ |
| Shown in the keys list | nk_live_ plus 6 more characters, then "…" — enough to recognize it |
| Stored | SHA-256 hash of the full key only — the plaintext is never persisted |
| Who can create or revoke | Any member creates and revokes their own keys; the workspace owner can revoke any |
| Rate limit | 120 requests per minute per key, across the REST API and MCP. Over the limit returns 429 with a Retry-After header |
| Last used | Stamped on each authenticated request, best-effort |
See the REST API for what a key can call, and connect Claude and other AI assistants (MCP) for the MCP-specific setup.
Spotted something out of date? Email hello@neokivo.com.