API keys let an outside app, usually your own AI app, work in ContentForge for you. You only need a key for apps that can't sign in. An AI assistant that can sign in (such as Claude or ChatGPT) connects that way instead; see Connect your AI assistant with MCP.
Create a key
- Go to Settings → API & MCP.
- Under Create an API key, give it a Name you'll recognize, like "Reporting bot – office laptop".
- Choose What it can do:
- Read only: clients, sites, pages, posts, collection items and reporting. It can't change anything.
- Read + write drafts: also edits site drafts (pages, widgets, header and footer, menu, popups, theme), blog post drafts and hidden collection items, adds clients, blank sites and pages, saves social post and press release drafts, and can start Zeus scans and SEO tools (they ask before charging credits).
- Read, write + publish: also publishes the site or a page, publishes blog posts and shows collection items.
- Pick when it Expires: Never, In 30 days, In 90 days or In a year.
- Click Create key.
- Copy the key straight away and click I've saved it. For your security it's never shown again.
What a key can reach
A key acts as the person who made it. It can only reach what your role and tool access allow in your agency, and it stops working if you leave the agency. Treat it like a password.
A key with Write can also start Zeus scans and SEO tools, which cost credits. Each one shows its cost first and only runs once you agree. See Connect your AI assistant with MCP. Everything else a key does is free.
Each key can make 120 requests a minute. To put a key into an app, see Connect Cursor and other apps with an API key or Connect Claude Code and other command-line tools. For what each level allows in detail, see MCP permissions explained.
Manage your keys
The keys table shows each key's name, the start of the key, what it Can do, when it was last used and its status (Active, Revoked or Expired).
- Click the pencil next to a name to rename it.
- Click Revoke, then Yes, to switch a key off for good. Make a new key if you need access again.
For Owners and Admins
You see Your agency's keys, including who each key Acts as, and can revoke any of them. Recent changes made through the API lists every change, which key made it, and whether it worked.