# Agent Keys

Keys authenticate external MCP clients against a specific AI agent endpoint.

Keys are only shown once. Copy and store them securely immediately after creation — Crank stores only a hash. `Last used` updates after successful MCP authentication.
Agent access
Select the AI agent whose MCP endpoint should accept this key.
AI agent
Machine access modes
This build exposes the stable machine-access contract and shows which modes are available now.
Community currently supports static AI-agent keys.
Short-lived and one-time token issuance uses the same public HTTP surface, but requires a commercial edition.
Active keys
3 active · 1 revoked

Name | Key prefix | Scopes | Created | Last used | Status |
--- | --- | --- | --- | --- | --- | ---

Scope reference
read
Initialize MCP sessions, ping the server, and list tools for a workspace agent.
write
Execute `tools/call` requests against published agent toolsets.
deploy
Reserved for deploy-scoped automation. Today it also permits MCP read/write flows.
Create agent key
Key name
A descriptive label to identify the key. Only visible to admins.
Scopes
Copy this key now. It won't be shown again.
mcp_prod_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx