API and MCP

API keys

Who can create keys, what a key can read, and how to revoke one.

Creating a key

Workspace admins and the owner create keys on the API and MCP page of the workspace. Give each key a name that says where it is used, such as "Looker Studio" or "Cursor, Anna". The secret, starting with bl_, is shown once, right after you create it. Botlum keeps only a fingerprint of it and cannot show it again. If you lose it, create a new key and revoke the old one.

What a key can do

• Read the workspace it was created in, as a viewer: projects, prompts, visibility, answers, sources, exports.
• Use the REST API and the MCP server.
• Nothing else. It cannot change anything (403) or see another workspace (404).

Seeing keys

The list shows each key's name, the first characters of the secret, who created it, when, and when it was last used. That is enough to find an unused or unknown key.

Revoking a key

Click Revoke. The key stops working at once. A key also stops working, on its own, when the person who created it leaves the workspace or is no longer an admin. If a teammate leaves, the keys they made do not keep working behind your back.

Keeping keys safe

• Use one key per tool or person, so you can revoke one without breaking the rest.
• Keep keys out of code repositories. The bl_ prefix lets secret scanners spot a leaked key.
• Prefer signing in over keys for AI assistants that support it: see Connect an AI assistant.