# Create an API key; connect an AI assistant

> Give a website, a script or an AI assistant its own read-only key, choose how much of your catalog it sees, and connect an assistant over MCP.

Source: https://www.speclatch.com/guide/portal-api/api-keys-and-mcp
Who: Admin. Plan: Growth plan and up.
Last verified: 2026-11-11

Give each system that needs your catalog its own API key: a website, a quoting script, or an AI assistant that answers questions about your specs. It then reads live records instead of an exported copy that goes stale. This guide creates a key, then connects an assistant with it.

## What a key can read

Every key is read-only. The API answers read requests only, and an assistant's tools go through the same API, so changes still happen in the app.

What a key reads depends on its visibility, chosen when you create it. Like a member's, it is the most the key will ever see:

- A Public key reads Published records only, with their Public fields, files and documents, as your portal does.
- An Internal key adds Draft and In review records, Internal fields and tags.
- A Confidential key reads every field.

Say a ball valve's Cv is Public and its list price is Internal. An assistant with a Public key quotes the Cv, but asked for the price, it finds no such field. Choose the lowest visibility that does the job, because an assistant can repeat whatever its key reads to anyone who uses it.

## Before you start

- You need the Admin role.
- The API comes with the Growth plan and up, and with the trial. Growth includes one active key; Professional has no limit.
- For the second part, you need an assistant that accepts an MCP server with a header, such as Claude Code, Cursor or VS Code.

## Create a key

1. Open Settings, then **API keys**.
2. Under *Key name*, type what the key is for, such as *Sales assistant*.
3. Under *Visibility*, choose the tier the key needs.
4. Click **Create key**.
5. Click **Copy** in the box that appears, and keep the key in your password manager.

![The API keys page with Sales assistant as the key name, Visibility at Public, and an empty key list.](https://www.speclatch.com/guide/portal-api/api-keys-and-mcp-1.png)

*A new key starts at the lowest visibility.*

This is the only time SpecLatch shows the key, because it keeps only a fingerprint of it. If you lose a key, create a new one and revoke the old.

## Connect an AI assistant

SpecLatch is an MCP server. MCP, the Model Context Protocol, is how AI assistants reach outside tools. The assistant sends your key with every request, so it sees what the key sees.

1. In your assistant, open its settings for MCP servers.
2. Add a server with the address `https://app.speclatch.com/api/mcp`.
3. Add a header named `Authorization` whose value is `Bearer`, a space, then your key.
4. Ask something that needs your data, such as *Which tables are in SpecLatch?*

The assistant calls the `list_tables` tool and names your tables. For a spec question, it reads the table's fields and units with `describe_table`, then finds records with `search_records` and `get_record`. The [developer docs](/developers#mcp) give the exact setup for Claude Code, Cursor, VS Code and Claude Desktop.

> **Connectors that sign in.** Assistants that connect through a sign-in page instead of a header, such as the claude.ai and ChatGPT connectors, can't use a key.

> **Tip:** Each request counts against the key's rate limit: 120 a minute on Growth, 600 on Professional. An assistant's tool call is one request.

## Replace or revoke a key

The list shows each key's *Visibility* and when it was *Last used*. Revoke a key that leaked, or one nothing uses any more.

1. Click **Revoke…** on the key's row.
2. Click **Revoke key**.

Anything using the key stops working at once, and a revoked key can't be restored.

> **Tip:** On Growth, which counts one active key, revoke the old key before you create its replacement. A key's visibility can't be edited, so change it the same way.

## What happens after

The key belongs to the workspace rather than to you, so it keeps working when members change. **Activity** lists who created or revoked each key. Keys stop answering while the plan doesn't include the API.