Create an API key

Follow the steps

1. 1

   Sign in, open Settings → API keys, and choose Create API key.

2. 2

   Give the key a descriptive name, choose the smallest required non-empty set of scopes, and set an expiry. Valid personal-key scopes are boards:read, boards:write, library:read, and library:write. The browser extension uses its own sign-in flow and needs no personal key.

3. 3

   Copy the raw canvasperch_sk_ secret immediately. The create response shows the raw key once; later lists and account exports contain metadata only.

4. 4

   When a key is no longer needed, revoke it from Settings. Revocation takes effect immediately.

Choose only the access you need

Personal keys always expire: the default is 90 days and the maximum is 365 days. Choose a non-empty subset of the available scopes and revoke the key when the connection is finished.

Code examples

Replace placeholders in your own protected environment. Never paste a real key into a public page, browser bundle, prompt, screenshot, issue or repository.

{
  "name": "Research archive",
  "scopes": ["boards:read", "library:read"],
  "expiresAt": "2026-12-11T17:00:00.000Z"
}

What to know

• The default key lifetime is 90 days and the maximum is 365 days. An account can have at most 20 unexpired, unrevoked keys, and key creation is rate limited.
• Personal keys authenticate only the /api/v1 REST routes and /mcp. They do not authenticate browser session, account, billing, admin, upload, job, or other ordinary /api routes.
• A revoked or expired key, or a key belonging to a disabled or deleted account, fails immediately. Personal keys do not use the OAuth resource audience.

Troubleshooting

• If the key is lost after the one-time response, create a replacement and revoke the old key. Canvas Perch cannot display the raw secret again.
• If creation returns an invalid-scope error, remove wildcard or unknown scopes and choose a non-empty subset of the supported scopes.
• If the account has reached its active-key limit, revoke an unused key or wait for an existing key to expire before creating another.