Create and manage API keys and MCP tokens
API keys and MCP tokens each let you connect your own tools or scripts to Sandtime.io, through the REST API or the MCP server respectively, without sharing your account password.
Good use cases
- scripting reports or exports outside the app,
- connecting an AI assistant through the MCP server,
- integrating Sandtime.io data into your own internal tools.
Creating a key
Use whichever page matches what you’re setting up:
From the API page
- Go to Settings > Integrations > API.
- Click Create API key.
- Copy the key right away - it’s shown once and never displayed again.
From the MCP page
- Go to Settings > Integrations > MCP.
- Click Create API key.
- Copy the key right away - it’s shown once and never displayed again.
For the exact steps to connect Claude Desktop, Claude Code, ChatGPT/Codex, or any other MCP client with that key, see the step-by-step setup guide.
Reading the list
Settings > Integrations > API lists everything issued to you, split into Active and Revoked. Each row has:
- Connection - what the key belongs to. A key you created yourself reads API key with a Created by you badge. A key an AI assistant obtained by connecting through the MCP server reads the name the client registered under, with an AI assistant badge.
- Key - the first characters of the key’s identifier, enough to tell two rows apart. The key itself is never shown again after it’s created.
- Scope - the subdomain of the organization the key can read, which is the organization you were in when it was created. A key issued before keys were tied to a single organization reads
*instead and isn’t limited to one organization. - Created and Expires - when the key was issued and when it stops working. On a revoked row the second date is when it was revoked.
The list is per person: it shows what you created, not your teammates’ keys and connections.
Revoking a key
Go to Settings > Integrations > API to manage every key, no matter where it was created. Revoking a key from the Active list takes effect immediately, so anything still using it loses access right away.
Revoke all removes every active key at once, and also signs you out of your current session, since sessions and API keys share the same underlying mechanism. You’ll need to sign back in afterward.
The same applies in reverse: Sign out revokes your API keys. Every key issued before you signed out stops working and is listed as revoked when you sign back in, so any integration using one needs a new key.
Disconnecting an AI assistant
A row with the AI assistant badge is a connection rather than a key you hold: the assistant obtained it through the MCP server and keeps it itself. Click Revoke on that row and confirm with Disconnect. The assistant loses access to your Sandtime.io data right away, and to use it again you have to connect it from scratch.
After revoking
Revoked keys stay listed with their creation and revocation dates for reference, but can’t be reactivated - create a new one instead.