# API keys Create, list and revoke the scoped keys that authenticate the hosted MCP endpoint; the plaintext is shown once, at creation, and stored only as a hash. A key carries scopes — read for the hub’s read tools, run for jobs that spend credits, publish for your own artifacts. A key with only the scopes it needs is the difference between a leaked token that reads and one that spends. ## Shown once, stored hashed What the API keeps is a non-secret lookup prefix and an Argon2id hash of the rest, so a key can be listed and revoked forever but never displayed twice. Losing one means issuing another and revoking the old, not recovering it.