API keys
Create a key for a script or an assistant, choose what it can do, and revoke it when you're done.
An API key lets a script, Claude Code, Cursor or any other tool work in one of your workspaces as you. Each key belongs to you and to the workspace you made it in.
If your assistant can sign in instead (Claude.ai and ChatGPT do), you don't need a key: see Connect Claude.ai.
Create a key
Copy it now
Cheqq shows the key once. Copy it somewhere safe: anyone who has it can act as you in that workspace. If you lose it, revoke it and create another.
Under Start using it, the same screen has the key already filled in to
ready-to-paste setup for Claude Code, Cursor's mcp.json, and a curl
command that checks it works.
A key starts with cqk_. Send it in the Authorization header of every
request:
Authorization: Bearer cqk_your_key_hereWhat a new key can do
A new key starts able to see everything, add and change records, and run
automations. Anything that deletes, reshapes a Wapp, builds automations,
edits documents and Apps, or publishes is something you tick on purpose.
Give each key only what its job needs: a reporting script needs nothing but
records:read.
A key never does more than you can
- It acts as you, and everything it does is attributed to you.
- It reaches only what you can reach in that workspace, with your role in each Wapp. A Wapp you can only view stays read-only, whatever the key's scopes say.
- If you can only view the workspace, you can't create keys for it. If you're moved to viewer later, your keys keep working but can only look.
- If you leave the workspace, or are removed from it, your keys and connected apps for it are revoked, and stay revoked if you're invited back.
Keys on your plan
Each plan gives each person a number of active keys in each workspace. Revoked and expired keys don't count.
| Plan | Keys per person, per workspace |
|---|---|
| Free | 2 |
| Pro | 10 |
| Business | 25 |
| Team | 50 |
When you've used them all, Cheqq asks you to revoke one you no longer use or to upgrade. How many requests a key may make is on Rate limits.
See and revoke your keys
Settings → Developer lists your keys in the current workspace with the first characters of each, what it can do, when it was last used and when it expires.
Select Revoke key to stop one. It stops working on its next request, and
anything using it gets 401 INVALID_TOKEN. Revoking can't be undone; create
a new key if you need one again.
If a request is refused
| Status | Code | What it means |
|---|---|---|
| 401 | UNAUTHORIZED | No key was sent. |
| 401 | INVALID_TOKEN | The key was revoked, has expired, or isn't a Cheqq key. |
| 403 | INSUFFICIENT_SCOPE | The key works but wasn't given this permission. details.requiredScope names the one it needs. |
| 403 | WORKSPACE_ACCESS_LOST | The key's owner is no longer a member of its workspace. |
| 403 | ACCOUNT_SUSPENDED | The account that owns the key is suspended. |
Scopes can't be added to an existing key. Create a new key with the scopes you need and revoke the old one.