Skip to main content

API keys

Reactor uses API keys to authenticate requests to the MCP server. Each key is scoped to a workspace and owned by the member who created it.

Generating an API key​

  1. Go to Settings → API
  2. Click Generate New Key
  3. Give the key a name (e.g., "Claude Desktop", "n8n automation")
  4. Click Create
  5. Copy the key immediately; it is only shown once

Any member can generate keys for their own use, contributors included. An active subscription (or trial) is required.

How the key is stored​

Reactor stores only a SHA-256 hash of the key, never the plaintext. If you lose a key, generate a new one and delete the old entry.

Using the key​

The quickest way to connect is the @reactor-tools/mcp package; it detects your editor and wires Reactor in:

npx @reactor-tools/mcp install --key sk_your_key_here

It supports Claude Code, Cursor, Claude Desktop, and Windsurf (add --client <name> or --client all). See Install the MCP for every option, and Use Reactor in your codebase for running your repo's copy through the engine.

To configure a client by hand, the package acts as a branded bridge; the endpoint stays out of your config and the key rides in env:

{
  "mcpServers": {
    "reactor": {
      "command": "npx",
      "args": ["-y", "@reactor-tools/mcp"],
      "env": { "REACTOR_API_KEY": "sk_your_key_here" }
    }
  }
}

The Settings → API page shows the exact MCP endpoint for your deployment. See Authentication for full setup.

Revoking a key​

Click Delete next to any key on the API page to revoke it immediately. Any MCP client using that key will receive a 401 error until it is reconfigured with a new key.

Contributors see and revoke their own keys; managers and owners see and can revoke every key in the workspace. When a member is removed from the workspace, all of their keys are revoked automatically, and every MCP request re-checks the key owner's live membership.

Key naming​

Use descriptive names so you can track which keys are used by which integrations. If a key is compromised, you can identify and revoke it without disrupting other integrations.