Create and manage Session API keys

Session API keys let your service create sessions, read progress, and send follow-ups in one workspace. They are separate from browser sign-in and the OAuth authorization used by Uno MCP.

Create a keyCopy Anchor Link

1. Sign in as a workspace owner or admin.
2. Open Settings → Integrations → Session API using the API-key integration card.
3. Enter a name that identifies the caller, such as “Build triage service.”
4. Choose Create key.
5. Copy the revealed secret immediately into your service's secret storage.

Keys begin with uno_ws_. Uno stores a hash and display metadata; the full secret is returned only once. A replay of key creation does not reveal the original secret again.

Understand accessCopy Anchor Link

A key belongs to one workspace. A key for one project cannot read or mutate a session owned by another workspace.

The supported scopes are sessions:read and sessions:write. The web creation flow creates the standard key; programmatic key management can supply supported scopes and an expiry. Creating and revoking keys require the signed-in user's administrative access, rather than another Session API key.

Store keys on a trusted server. Do not embed them in browser code, commit them to a repository, or include them in screenshots or support messages.

Rotate or revokeCopy Anchor Link

Create a replacement key, update the caller, verify its access, and revoke the old key using the integration page. Confirm which caller uses a key before revoking it.

New API requests check revocation and expiry. An open event stream is authenticated when it connects; close and reconnect clients during rotation rather than assuming an existing stream was reauthorized. Revoking a key is separate from cancelling work already accepted.

Continue with the Session API workflow and reference.