What is an API key?

In one sentence

An API key is a long secret code that proves to a service that a request comes from you, so it works like a password for software rather than for people.

In more detail

Your AI agent sends the key with every request to Spaces. Spaces checks it and then lets the agent use your connected accounts.

Anyone who has the key can do what your agent can do, within Spaces' limits. That is why it is shown only once, when it is created.

If a key leaks, you replace it. The old one stops working, and you give the new one to your agent.

A password lets a person sign in. An API key lets a piece of software, such as your AI agent, sign in on your behalf without you typing anything each time. It is long and random so that nobody can guess it.

You do not always need one. Most AI apps can now connect to Spaces with a sign-in in your browser instead, which is simpler and leaves no key to copy around. Keys are still useful for apps that prefer them, and for developers.

What a Spaces key looks like

Every Spaces key starts with spc_live_, followed by a long string of random letters and numbers. The prefix makes it easy to recognise if you ever find one somewhere it should not be.

When an AI app asks for a header, the key goes in like this:

Authorization: Bearer spc_live_…

Sign-in or key: which to use

Every AI app on the Spaces setup pages can sign in, and a key works as an alternative. If you are unsure, choose sign-in.

Adding a key to your AI agent, step by step

1. Create a key in Spaces and give it a name that says where it will live, such as "Claude on the office laptop".
2. Copy it straight away. Spaces shows it once and never again.
3. Open your AI app's settings and add Spaces with the address https://api.spacesos.com/mcp.
4. Where the app asks how to connect, choose a request header, and paste Authorization: Bearer followed by your key.
5. Save, then ask your agent to list your connected accounts to check it works.
6. Delete any copy of the key you pasted into a note or document along the way.

In Claude Code, the whole thing is one command with the key as a header:

claude mcp add --transport http spaces https://api.spacesos.com/mcp --header "Authorization: Bearer spc_live_…"

Where to keep it, and where never to put it

If Spaces support ever needs to look into a problem, they will not need your key. Never send it to anyone who asks for it.

One key per agent

You can have more than one key. Giving each AI agent, or each person, its own key means you can pause or delete one without touching the others. Naming them clearly makes it obvious which one to remove when a laptop is replaced or someone leaves.

For extra caution, a key can be draft-only: its replies and new chats always wait for a person to approve them before anything is sent. Approvals are being turned on workspace by workspace.

If you think a key has leaked

1. Create a new key in Spaces.
2. Put the new key into your AI agent and check it works.
3. Delete the old key. From that moment it stops working.
4. Look through recent conversations on your connected accounts for anything you do not recognise.
5. If something looks wrong, pause all sending in the workspace while you look into it. Reading keeps working while sending is paused.

Do this straight away, even if you are not sure. Replacing a key takes a few minutes, and there is no harm in doing it when it turns out nothing happened.

What a key can and cannot do

• It can read conversations on the accounts you have connected, and send messages within Spaces' limits.
• It cannot make an account send faster or more than its limits allow.
• It cannot message anyone who has said stop in that chat.
• It cannot send the same cold text to many people, because Spaces refuses that for every key.
• It is not your WhatsApp, Instagram or email password, and it cannot be used to sign in to those apps.

These limits mean a leaked key is a problem you fix quickly, not a disaster. It is still worth treating like a password, because it can send messages from your accounts.

Signs a key may have been seen by someone else

• You pasted it somewhere other people can read, even briefly, such as a group chat or a shared document.
• It appeared on screen during a video call or in a screenshot you sent.
• A laptop or phone that held it was lost, sold or passed on.
• Someone who had it has left the business.
• You see replies or new conversations on your accounts that nobody on your team remembers sending.

Any one of these is reason enough to replace the key. It is quicker to replace a key than to work out whether anyone actually used it.

Common mistakes

• Pasting the key into a chat message instead of the app's settings. Chats can be saved, shared or seen on screen.
• Sharing one key across the whole team. When one person leaves, everyone has to change it.
• Keeping old keys you no longer use. Delete them, so there are fewer secrets to worry about.
• Taking a screenshot of the setup screen to send to a colleague, with the key visible in it.

Why it matters for your business

• Treat it like a password: never post it, email it or paste it into a public place.
• Give it only to the AI agent you use, in that agent's settings.
• Replace it straight away if you think someone else has seen it.
• Choose sign-in instead of a key where your AI app offers it, and there is nothing to leak.

How Spaces handles it

Spaces keys start with spc_live_ and are shown once. Some AI agents can also connect with a sign-in instead of a key. Either way, every account stays inside Spaces' limits, whatever the agent asks.

You can create several keys, pause one, or delete one at any time. Whichever key or sign-in an agent uses, the limits belong to each connected account, so a second key never adds to what an account can send.

In short

An API key is a password for software. It lets your AI agent use Spaces on your behalf, so keep it in your agent's settings and nowhere else, give each agent its own, and replace it the moment you are unsure.

If your AI app offers sign-in, use that and skip the key altogether. The setup page for each AI app shows both options.

Where do I put the API key?

In your AI agent's settings when you add Spaces. The setup page for each agent shows the exact step.

What if I lose it?

Create a new one. Spaces never shows an old key again, so a lost key is simply replaced.

Can I have more than one key?

Yes, for example one per agent, so you can replace one without affecting the others.

Do I need a key if my AI app signs in?

No. If you connect with a sign-in in the browser, there is no key to copy or keep safe. A key is an alternative, not an extra step.

Is the API key the same as my WhatsApp or Instagram password?

No. It is a Spaces key and only works with Spaces. Your platform passwords are never typed into your AI agent.

What does spc_live_ at the start mean?

It marks the code as a live Spaces key. That makes it easy to spot if one ends up somewhere it should not, such as a shared document.

Should I give my key to a developer who is helping me?

Create a separate key for them, named after them, rather than sharing the one your agent uses. When the work is done, delete it, and your own agent carries on unaffected.

Can I limit what a key can do?

Yes. A key can be draft-only, so everything it writes waits for a person to approve it before it is sent. Approvals are being turned on workspace by workspace.