API keys & access

Create a project key

Select the correct project and open API keys ↗. Give the key a name that identifies the integration or application using it. A key belongs to one project, starts with rlv_, and requires its creator to retain active membership in that project.

Copy the key when it is shown and store it in your server’s environment or secret manager. Treat it as a password. Choose an expiry from 1 to 3,650 days, or none. A project can hold up to 50 active keys.

Choose its scopes

Each key carries only the scopes you choose. The app selects every scope at first, including tools:execute, which spends your team’s balance; untick the ones the integration does not need.

project:read
  Read the team and project the key belongs to.

usage:read
  Read this month's request count and spend.

tools:read
  Search the catalog, read tool definitions and connections, and get quotes.

tools:execute
  Run tools, cancel executions, upload files, and create or change workflows, triggers, monitors, custom tools and team skills.

executions:read
  Read executions, results, artifacts, workflow runs and trigger and monitor events.

A request that needs a missing scope fails with 403 platform_api_key_scope_required, and details.scope names the scope. Use separate keys for separate integrations so that you can understand their usage and revoke access independently.

Limit tool access

Project members share the project's resources. In Tool execution on Project details ↗, a project administrator chooses all tools or a selected list of native, connected-app and custom tools. The policy also applies to administrators, API keys, CLI and MCP. All tools includes future additions; an empty selection blocks every tool. Each key can carry additional limits on the connections, custom tools and skills it may use. A call outside its allowed access fails with 403, and details.code is platform_tool_access_denied for a tool or platform_connection_access_denied for a connection. The key's scopes and connection-wide restrictions still apply.

Send the key securely

Send the key as a Bearer token over HTTPS:

Authorization: Bearer YOUR_RELVO_API_KEY

Keep keys out of public repositories, browser bundles, mobile apps, URLs, screenshots and shared logs. The API refuses browser requests from other sites.

Sign-in for MCP clients

Remote MCP clients do not need an API key. They sign in with OAuth 2.0 (authorization code with PKCE and dynamic client registration) and receive access to the project and scopes the user approves.

A sign-in lasts 90 days; access tokens last one hour and are refreshed automatically.

Rotate or revoke

When replacing a key, update the integration with its new credential and confirm that requests succeed. Revoke the old key when it is no longer needed.

If a key is exposed, revoke it in the app and replace the credential in the affected integration. Check its recorded usage.