Create a key
Sign in to the workspace and open Settings. Create a key with a label that explains the client or integration using it. The full key is shown only once. Store it in the secret storage of the client or environment that needs it.
The server stores a hash rather than the full key. Losing the displayed value means you should create a replacement and revoke the old key, not try to recover it from the database.
Use Bearer authentication
Authorization: Bearer YOUR_API_KEY
Do not paste an actual key into a chat conversation, a support ticket, a public code example, a browser URL, or a committed configuration file. Use an environment variable such as TOPDOER_API_KEY where your client supports it.
Scope and separation
Keys belong to an organization. Use separate keys for distinct clients so a change in one integration does not require distributing a shared secret everywhere. Treat a key as permission to request work within that organization, not proof that every proposed call or text has been approved.
Rotate and revoke
Revoke keys that are no longer needed, rotate a key if it may have been exposed, and update the client securely. Keep a record of the integration owner and intended use. The application should reject revoked or unrecognized keys even if a client still has a local copy.
Calls still need approval
A valid key does not bypass recipient eligibility, verification, calling hours, available credits, or plan limits. Call and text tools also require explicit approval of the intended action. Read the MCP tools reference before connecting an assistant that can request communications.