DocsOpen app
Docs/Reference/API keys

API Key Management

API keys authenticate programmatic access to Prowlo — both the MCP server (for AI tools) and the REST API. Each key is tied to your organization and grants full access to its data.

Creating an API Key

API keys can only be created by admins and owners of your organization. To generate a new key:

  1. Navigate to API Access in your Prowlo dashboard
  2. Click the Generate Key button
  3. Give your key a descriptive name (e.g., Claude Desktop, Cursor)
  4. The full API key is displayed once — copy it immediately and save it somewhere secure
  5. Keys follow the format prowlo_ followed by 64 hexadecimal characters

Security Best Practices

  • Never share API keys in public repositories, chat messages, screenshots, or emails
  • Create one key per tool or integration — easier to revoke if compromised
  • Revoke unused keys promptly from the API access page
  • Treat API keys like passwords — they grant full access to your organization's data
  • Store keys in secure environment variables, not in source code

Revoking an API Key

If a key is compromised or no longer needed, revoke it immediately:

  1. Go to API Access
  2. Find the key you want to remove
  3. Click the trash icon to revoke it
  4. Revoked keys stop working immediately — any MCP sessions using that key will disconnect

What a key can access

A key grants full access to your organization's data. The same key works for both interfaces:

  • MCP — connect an AI tool (Claude, Cursor, Windsurf, …) to browse your Dataset and manage Watchers, keywords, alerts, and trends. See MCP integration for the available tools.
  • REST API — call the v1 endpoints directly from your code. See the API reference.

Reads are org-scoped: a key only ever returns data from the channels your organization watches.

Rate Limits

Each API key is rate-limited to 60 requests per minute. This applies to MCP tool calls and REST API requests made with that key.

Responses include standard rate-limit headers:

RateLimit-Limit: 60
RateLimit-Remaining: 45
RateLimit-Reset: 42

The RateLimit-Reset header shows the seconds until your quota resets. If you exceed the limit, you'll receive a 429 Too Many Requests response — simply wait for the reset window and retry.

← WindsurfTroubleshooting →