Create and manage API keys

An API key lets a program act on your organization's Koast data without anyone signing in. Use one for an MCP client that only accepts a static token, for your own code calling the Koast REST API, or for the koast command line on a server or in CI.

Most assistants, like Claude and ChatGPT, connect by signing in and never need a key. See Connect Koast to your AI assistant.

Before you start

• Only the organization owner and admins can create, see and revoke keys. Other members can open API & Webhooks too, but they only see their own Authorized apps, not the organization's keys.
• Keys belong to the organization, not to the person who made it. A key keeps working when its creator leaves the team.
• MCP access needs a paid plan with an active subscription. API access needs an Agency plan with an active subscription.

Create a key

1. Open Settings and pick API & Webhooks

   API & Webhooks sits under General. Select Create key.

2. Name it

   Name it after the program that will use it, like "Reporting script" or "Claude Desktop", so you can tell your keys apart later.

3. Pick where it works

   Under Works with, MCP lets an AI assistant use it on the Koast MCP server. API lets your code and the CLI use it on the REST API. Turn on only what the key needs. The API toggle is unavailable unless your organization is on an Agency plan.

4. Pick the access

   Read reads your Koast data. Write changes it. Publish pushes campaigns live to the ad platform. A new key is Read only until you add more.

5. Limit it to some brands, if you want

   By default a key reaches every brand in your organization. Pick brands to limit it. A limited key can't see or touch any other brand.

6. Set an expiry

   Keys never expire unless you set a date. After that date the key stops working.

7. Set a publish limit, if you picked Publish

   Publish limit is the most this key may ever put live, in total. To let the key publish any amount, turn on Unlimited next to it instead. Publishing is refused with neither.

8. Copy the key

   Select Create key. The key is shown once. Select Copy and paste it into your program now. It starts with koast_sk_. The window stays open until you select Done, so a stray click or Esc can't close it before you've copied the key.

What each setting does

A key acts with the access of an organization admin, narrowed to the access, brands and surfaces you picked. If your organization moves off the plan a surface needs, the key is refused there until the plan is back.

What the list tells you

The list shows each key's name, the start of the key, its access, where it works, its brands, who created it, when it expires, when it was last used, and its publish limit with how much of it is already used. An unlimited key shows Unlimited, with what it has published so far once it has published anything. The last used date is the fastest way to spot a key nothing is using any more.

See what a key did

Changes made with a key show up in activity logs, launch history and Slack updates as API key: followed by the key's name. That's another reason to name each key after the program that uses it.

Revoke a key

Revoke a key the moment you stop using it. Anything still using it stops working on its next request, and it can't be undone.

For developers

How to send the key and the errors you can get back are in the authentication guide. The full API reference is on the Koast developer docs too.