API keys

Format

Send the key as an HTTP Bearer token:

Authorization: Bearer topcal_live_<32-char-secret>
# or
Authorization: Bearer topcal_test_<32-char-secret>

Where to mint keys

Sign in to your workspace, then open Settings → API keys. Create a key, copy it once, and store it in your agent’s secret store. Native email verify and CLI device approval also mint a key (one new key per success; older keys including legacy tofu_* stay valid until revoked).

List and revoke over REST

The key owner can manage keys without the dashboard:

GET /api/v1/workspace/api-keys
DELETE /api/v1/workspace/api-keys/{apiKeyId}

Responses are metadata only (prefix, scopes, timestamps) — never the secret. Any key can see and revoke itself. A key with workspace.act can also manage the other keys its creator made, and every key in the workspace when that creator is an owner or admin. Read-only keys only ever reach themselves. CORS stays closed; call from your agent, not a browser on another site.

Agent seats

Free named credentials on a human-owned workspace. How many a workspace can have follows its plan: 1 on Free, 3 on Starter, 5 on Plus, 10 on Growth. Activity is logged under the bot’s name. Revoke from Members → Agent seats or:

GET /api/v1/workspace/agent-seats
POST /api/v1/workspace/agent-seats {"displayName","agentEmail?"}
DELETE /api/v1/workspace/agent-seats/{id}

Which transport

• Keyed host MCP: /api/mcp/mcp
• Public booker MCP (no auth): /api/mcp/public/mcp
• REST: /api/v1 — see the OpenAPI reference