API keys

An API key is a credential for something that is not a browser: a script, an integration, or the MCP server an agent connects to. Keys begin with pb_.

Create one

1. Go to Settings → API keys.
2. Select New API key.
3. Fill in Name — what it is for, so the row means something in six months.
4. Choose Scopes — what the key may do.
5. Optionally set Expires.
6. Select Create key.

The key is shown once, with the line “Copy this key now. It is not shown again.” Pealboard stores only a SHA-256 digest of it and cannot show it to you or to anyone else afterwards. If you lose it, revoke it and make another.

What a key can do

A key acts as the workspace member who created it and can never do more than that member’s role allows. A key made by a viewer can read and cannot write, and promoting or demoting the member changes what their keys can do at the same moment.

Using one

Send it as a bearer token:

Authorization: Bearer pb_xxxxxxxxxxxxxxxxxxxxxxxx
X-Workspace-Id: <your workspace id>

Settings → Workspace shows the workspace’s name and address, not its id. Get the id from GET /account/workspaces, which lists every workspace the key can belong to. X-Workspace-Id is required whenever you belong to more than one workspace, because the API refuses to guess which one you meant.

The MCP server at https://mcp.pealboard.com/mcp takes the same key in the same header. See MCP.

Revoking

Select Revoke key on the row. It stops working immediately, everywhere. Any script using it gets a 401 on its next call.

Revoke a key when the person who made it leaves, when the script that used it is retired, and whenever you are not certain where a copy of it is.

What a key is not

It is not a session token and cannot be used to sign into the application. It is not a GitHub token: it cannot be used against GitHub’s API, and Pealboard’s own GitHub credentials are never exposed through it.