API Keys

Create and manage API keys to authenticate with the ACE v1 API and the MCP server.

Create and manage API keys in the dashboard to authenticate with the v1 API, the SDK, the CLI, and the MCP server.

Where to manage keys

In the app, go to Settings, Developer console, Keys. You can create keys, view key prefixes, set scopes and rate limits, and revoke or delete keys.

Key format

Keys carry their environment in the prefix:

ace_live_... runs against your account for real and draws on your credit balance.
ace_test_... is free and capped by a monthly quota, which makes it the right choice for a first integration.

The full key is shown only once, at creation. Store it securely. The dashboard shows only the prefix afterwards, for identification.

Scopes

Assign one or more scopes when creating or editing a key. admin grants all of the others.

Scope	Unlocks
`enrichment:read`	Read jobs, job results, usage, feeds, projects, and experiments
`enrichment:write`	Everything above, plus running rules, content, and pipeline enrichment, and cancelling jobs
`utils:read`	The utility endpoints: language detection, agentic readiness, and review quality scoring
`webhooks:read`	List webhook subscriptions and their delivery history
`webhooks:write`	Everything above, plus creating, updating, and deleting webhooks
`admin`	Full access to every resource

New keys get enrichment:read, enrichment:write, and utils:read by default. That is enough for the enrichment engine and the utilities, but not for webhooks: add webhooks:write if you plan to subscribe to job events.

Scopes are enforced on the MCP server too. A tool whose scope your key lacks returns a 403 naming the scopes it needs, so widen the key rather than retrying.

Environments and quotas

A ace_test_ key is free and metered against a monthly ceiling on both request count and units of work. When you exhaust it, calls return 402 TEST_QUOTA_EXCEEDED until the month rolls over. Check what is left with GET /api/v1/usage, which includes a testQuota block for test keys.

A ace_live_ key draws on your credit balance instead. See Credits and usage.

REST management (session auth)

To manage keys programmatically with session (cookie) auth:

List keys: GET /api/keys
Create key: POST /api/keys (body: name, optional scopes, rate_limit_per_minute, expires_at)
Get one key: GET /api/keys/[id]
Update key: PATCH /api/keys/[id] (for example scopes, rate limit, name)
Delete key: DELETE /api/keys/[id]

These routes require an authenticated session, not an API key.

Rate limits

Each key has a configurable requests per minute limit. When exceeded, the API returns 429 with Retry-After and X-RateLimit-* headers. Set the limit when creating or editing the key.