Skip to the content
cMCP
Signed in
Signed in
Profile

Your API keys

For everyone with a seat on a box. About 2 minutes.

What a key is

A key is a long secret that lets your AI apps, sessions and bots sign in to beebox as you. It is like a password for your programs. Anyone who has it can act as you in the box, so keep it out of chats, screenshots and code.

One per device, or one for everything

You can have up to 10 keys, each with its own name. Pick what suits you:

  • One key per device (for example Laptop, Office PC): if one device is lost, revoke only that key.
  • One key for everything: the least to manage.

Your apps and sessions that use a key show up on their own as your team, under that key.

Make a key

  1. Open API keys in the left menu.
  2. Type a Key name (1 to 40 characters, different from your other keys) and click Create key. The first time you may be asked to confirm it is you: click Confirm now, sign in, and try again.
  3. The key (it starts with bbx_k_) is shown once. Click Copy the key and keep it in your password manager. If you lose it, rotate that key to get a new one.

Use it on your computer

In a terminal run:

botbox connect

Paste the key when it asks. Nothing is shown while you paste.

Rename, rotate, revoke

Each key in the list shows its name, the start of the key (to help you recognise it), when it was made and last used, and how many sessions are live from it.

  • Rename: type a new name and click Save. The key itself does not change.
  • Rotate: makes a new key with the same name, shown once. The old key and every session made from it stop at once. Use it when a key may have leaked or you lost it. The device then needs the new key (botbox connect).
  • Revoke: stops that key and its sessions. Your other keys keep working. Revoked keys are listed under Earlier keys.

For developers: use the key on every call

Your own programs can skip the sign-in step: send the key on every request as Authorization: Bearer <key>, with X-App-Id (your app's name) and X-Session-Id (any id of your choosing for this run). beebox keeps one session for that app and run, shows it in your team, and reuses it on the next call. The same works for MCP clients on /mcp.

What a key can never do

A key never approves anything, never invites people and never changes rules or permissions: that always needs you, signed in on the web. Bots and apps that use a key act as your Jobbers only (see Your bots and Connect your computer).