API keys
The API tab, under the Developer group in Settings, is where you generate scoped API keys — the credential ForgeSend's MCP server and any other external tool uses to act on your workspace without a browser login. Every key is scoped: you pick exactly which resources it can read and write when you create it.
Generating a key
Only a workspace owner can generate or revoke keys — anyone else sees "Only the workspace owner can generate or revoke API keys" in place of the form. Generating one takes a label and at least one scope.
API Keys
Generate keys for external tools — like the MCP server — to access this workspace without a browser login. Each key is shown in full only once; it can never be displayed or recovered afterward.
Scopes — this key can only do what you grant here
Generation is disabled until the label is non-empty and at least one scope checkbox is checked. The full key is shown exactly once, immediately after generation, in an amber-highlighted box:
Copy this key now — it will not be shown again.
There's no way to view a full key again after this screen closes, and there's no "reset" that keeps the same prefix — losing a key means generating a new one and updating whatever used the old one. Only the key's first 12 characters (its prefix, e.g. fs_live_9jQ2) stay visible afterward, in the Active keys table below, to help you tell keys apart without ever exposing the rest.
The six scoped resources
Scopes are Read/Write pairs across six resources — twelve scope values in total. Campaigns and Sending are deliberately separate: campaigns:write covers editing a campaign's content and settings, while sending:write covers starting, pausing, resuming, and approving or rejecting held sends. A key that can edit a sequence can't necessarily launch it, and vice versa.
This is the same scope vocabulary used everywhere a key or token needs permissions in ForgeSend — including MCP OAuth consent screens, which present these same twelve values as the list of permissions an agent is requesting. A key created with only contacts:read and analytics:read, for instance, can search and view contacts and pull analytics, but can't create a campaign, register a webhook, or start a send — each of those needs its own explicit scope.
Active keys
Every non-revoked key for the workspace shows in a table — label, key prefix, granted scopes, when it was created, and when it was last used.
With no keys yet, the table is replaced with "No API keys yet — Generate one above to get started." Clicking Revoke shows an inline "Sure?" confirmation with Yes/No — there's no modal. Revocation is immediate and permanent: a revoked key is rejected on its very next use, with no grace period, and can't be un-revoked — you'd generate a fresh key instead.
Where to go next
Next: Webhooks