> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openlens.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and MCP

> How personal and organization API keys differ, which organization's projects each reaches, and how MCP binds to your organization.

Programmatic access uses an API key, created from **API Keys** in the sidebar. There are two kinds: **organization** keys, which you'll normally use, and **personal** keys, for quick testing.

## Organizations

Everything in OpenLens belongs to an **organization** — it owns your projects, data, seats, and billing. When you sign up you get your own. You can invite people into it — teammates to work alongside you, clients to view their own dashboards — or join someone else's if they invite you. Access to a project is always granted within its organization.

## Organization keys

An organization key is the standard way to work with an organization's projects programmatically. It belongs to the organization itself — a service account, not tied to any person, so it keeps working as people join or leave.

Use one for scripts, agents, reporting pipelines, a Slack bot, or a warehouse sync — anything that reads or writes your projects.

Only **owners** and **admins** can create or see organization keys. Because the key can read and write every project in the organization, it's limited to the roles that already have full-organization access — **members** and **clients** are scoped to just their assigned projects, so an org-wide key would over-grant them. See [roles and access](/organizations/overview) for the full breakdown.

An organization key can't govern the organization (no inviting members, changing roles, billing, or minting other keys), and it never holds a seat.

<Note>
  **Minting keys for others.** Give each integration or teammate its own named key (for example `CI` or `Sarah's reporting script`) instead of sharing one. Every key has a last-used time and can be revoked on its own, so you can see which key is active and cut off a single source without disturbing the rest. Actions are attributed to the **key**, not to a person — a key shared between people can't be traced back to an individual.
</Note>

## Personal keys

A personal key acts as you and is meant for quick testing of the API from your own account. For real work with an organization's projects, use an organization key. Any signed-in user can create one.

## Creating a key

1. Open **API Keys** in the sidebar.
2. Name the key (e.g. "CI integration", "Slack bot") and pick the scope. Anyone can create a **personal** key; only owners and admins can choose **organization** scope. A member or client who needs an organization key should ask an owner or admin.
3. Pick an expiry. Never, 30, 90, or 180 days.
4. Copy the secret immediately. It's shown exactly once. Lose it and you revoke and re-create.

Then send it on every request:

```http theme={null}
Authorization: Bearer <your_key>
```

The full walkthrough, from key to first visibility score, is in the [API reference](/api-reference/introduction).

## MCP and your organization

The [MCP server](/mcp/overview) uses OAuth, so there's no key to copy. When your agent connects, the session binds to your active organization, and the agent can do whatever your role allows: an owner's agent manages everything, a member's agent works its assigned projects, a client's agent reads its one dashboard.

API and MCP calls are metered per org per month, with allowances that scale by plan. The **Usage** page shows where you stand, and `GET /api/me/limits` returns the same numbers programmatically.