How do I create and use an API key?

How do I create a key?

1. Confirm your email address with the link we emailed you. If you cannot find it, choose Send a new confirmation link at the top of Settings.
2. Open Settings and expand Advanced.
3. Under Agent API keys, enter a New key label, like "Claude on my laptop".
4. Choose Create API key. Copy the key now. It will not be shown again.

Keys start with itk_. Only you can create keys, while signed in to the website. A key cannot create more keys.

What if I can't create a key?

• Confirm your email address first: open the confirmation link we emailed you, or choose Send a new confirmation link at the top of Settings.
• API key limit reached: the trial allows 1 key and Pro allows 3. Revoke an unused key in the same table (revoked keys do not count), or connect with OAuth sign-in, which needs no key.
• If your last payment failed, update your card in Settings first.

How do I use it?

Authorization: Bearer <your key>

Send this header to https://getinboxtriage.com/mcp or to routes under https://getinboxtriage.com/api. Start with the API reference.

What can a key do?

Over MCP, a key can do what a signed-in AI app can: read and search your synced mail, write drafts, label, archive, and trash. Reporting spam, unsubscribing, and sending still wait for you to approve each one in your AI app or on the approval page, and sending must be turned on first. Archiving or trashing a VIP message also asks you first. Over the REST API a key can add, rename, and remove inboxes, read, sync, write drafts, and manage the triage profile and leases, but it cannot archive, trash, label, report spam, unsubscribe, or send.

What are the rate limits?

Each key can make about 120 requests a minute to the REST API and 300 a minute to MCP. Past that you get HTTP 429 with a Retry-After header. Wait that many seconds and retry.

What if my key stops working?

• 401 missing_api_key: the request had no Authorization: Bearer header.
• 401 invalid_api_key: the key was revoked or not copied in full. Check it starts with itk_, or create a new one.
• 402 trial_expired or past_due: pick a plan or update your card in Settings. Over MCP the app still connects, but every tool call returns the same message.
• 429: you hit the rate limit. Wait for the Retry-After seconds.

How do I keep it safe or revoke it?

We store only a hash of your key. To revoke one, choose Revoke next to it in the same table and confirm. The key stops working right away and the row shows Revoked. To cut off every key and every connected app at once, use Disconnect all agents and API keys under Connected agents (shown while at least one app is connected through sign-in). Prefer OAuth sign-in when your app supports it, so there is no key to leak.