Panoptic Scans logo
Features Pricing Blog Docs About
Sign up

Existing customer? Sign in

From $25/month for 75 targets · 3-day trial, no credit card · Free scan of one URL or IP

Start free trial See pricing

API Keys

Navigate to API Keys

In the app, go to Settings → API Keys.

API keys page showing list of API keys with name, creation date, and last used date

Creating API keys

Enter a descriptive key name, then click Create New Key. Store the secret securely when it is shown; it may not be displayed again in full depending on your workflow.

Viewing and managing keys

For each key you can see its name, creation date, and last used date. Each key supports:

  • View — Shows the full key value when you need to copy it into a client or script.
  • Edit — Rename the key.
  • Delete — Revoke the key permanently.

Authentication

Keys authenticate the REST API and the MCP server. Exchange an API key at /api/token for an access token and a refresh token. OAuth clients such as Cursor also create a key here when an account holder allows access at /oauth/authorize. Deleting that key revokes the client. See the API documentation at /api and the API and MCP guide.

Info: The interactive API reference lists every endpoint, parameters, and response shapes.

View API Docs

How should I store API keys?

Treat API keys and refresh tokens as secrets. Store them in a password manager or a client secret store, rotate them if they leak, and give each integration its own named key so you can revoke one client without breaking others. Do not embed the long-lived key in a public frontend. The access token authorizes REST requests and POST /mcp. A 401 from either includes WWW-Authenticate. See the API and MCP guide for the refresh grant and rate limits.