BrunelDocs

Console

API keys

Create, scope, restrict, rotate and revoke Brunel API keys for the REST API and the MCP server. Read-only and read-write keys, expiry, IP allowlists and rotation with a grace period.

API keys authenticate the REST API and the MCP server. Manage them in Platform → API keys (https://console.brunel.cloud/keys).

Anatomy of a key

brn_w_Q2m9x…      read and write
brn_r_7Hc1b…      read only
  • The scope is part of the token: brn_r_ keys can only read (and call read-only MCP tools); brn_w_ keys can also analyze, design and refine. Changing the scope means creating a new key.
  • A key acts as you: your plan, your quotas, your projects, and the GitHub access of the session that created it (sealed), so private repositories keep working.
  • The secret is shown once. Brunel stores only its SHA-256 and the first characters, to recognize it in the list.

Create a key

Choose a name, a scope, an expiry (30, 90 or 365 days, or none) and optionally:

  • Allowed IPs: up to 20 IPv4 or IPv6 addresses or CIDR ranges. Calls from elsewhere get ip_not_allowed (HTTP 403).
  • Expiry reminder: a notification 7 days before the key expires.

Templates set sensible defaults: CI read-only (read scope, 90 days) and Agent read and write (write scope, 90 days). You can keep up to 10 active keys. Creating, rotating and revoking keys needs a sign-in from the last two hours.

Rotate without downtime

Rotate gives the key a new secret and keeps its id, name, settings and history. The previous secret stays valid for a grace period you choose: none, 1 hour or 24 hours. Deploy the new secret, then let the old one expire.

Revoke

Revoking stops the key at once. The console keeps a record (name, dates, never the secret) for 90 days.

Per-key usage

Open a key to see its requests, error rate, latency, top routes and tools, and its latest calls. Each call links to its entry in the request logs.

Good practice

  • One key per program or agent, so you can revoke one without touching the others.
  • Read-only keys for anything that only reads (dashboards, CI checks).
  • An expiry, an IP allowlist for servers with fixed addresses, and rotation on a schedule.
  • Never commit a key. Store it in your CI secrets or your agent's secure configuration.
API keys · Brunel Docs