API keys
Create and revoke organization API keys for automation.
Organization API keys authenticate the REST API and MCP server. Keys are scoped to a single organization.
Create a key
Open API keys in the app (organization settings)
Create a key with a descriptive name
Copy the secret once — it is shown only at creation time
Keys use the sk_ prefix. Store them in your secret manager; do not commit them to git.
Use a key
Authorization: Bearer sk_…
Base URL: https://app.pinnate.dev (or your deployment). See the live API reference for endpoints.
For agents, set:
PINNATE_API_KEY=sk_…
PINNATE_API_URL=https://app.pinnate.dev
See MCP.
Revoke a key
Delete (revoke) a key from the API keys page when it is leaked or unused. Revoked keys fail authentication immediately.