API Keys
Create, use, and revoke Conbersa API keys. Every MCP request authenticates with a cb_live_ key — there is no unauthenticated mode.
An API key tells Conbersa who is calling. Every MCP request needs one. Keys start with cb_live_, you make them in the web app under Settings → API keys, and there is no unauthenticated or development mode — a request without a valid key is simply refused.
Create a key
- Sign in to the web app at app.conbersa.ai.
- Open Settings.
- In the API keys section, create a new key.
- Copy it now. It is shown once.
Store it the way you store any production secret: a password manager, a vault, or your platform's environment variables. Not a repository.
Use a key
Send the key on every MCP request, in either header:
X-API-Key: cb_live_your_key_here
or
Authorization: Bearer cb_live_your_key_here
Both work. If your client can't set a custom header on preflight, use Authorization.
Revoke keys
- Revoke one — remove a single key by ID. Do this when a key is rotated or a machine is retired.
- Revoke all — kill every key on your account at once. Do this if a key may have leaked.
Revocation is immediate. A request already in flight may finish, but the next one with a revoked key returns 401 Invalid or revoked API key.
What a key can access
A key acts as you. The tools enforce the same ownership rules as the web app:
- You see only the devices and sessions that belong to you, or that you manage for someone else.
- Administrators can see and act on the whole organization; non-admin keys cannot.
- Keys belong to one owner. There is no shared or global key.
Security notes
- Never put a key in client-side code. The key belongs to your server or agent, not to a browser.
- One key per integration. Then you can revoke one client without breaking the rest.
- Rotate on suspicion. If a key shows up in a log, a screenshot, or a shared config, revoke it and make a new one.
Next
- MCP quickstart — connect a client with your new key.
- MCP troubleshooting — what a 401 or 403 actually means.