Most clients should connect with the browser sign-in, it needs no key and refreshes itself. API keys exist for clients without that support, and for scripts.
Creating a key
- Open Settings → API & MCP.
- Type a name that says where the key will be used (for example, “Edward’s laptop”).
- Click Create key.
- Copy the key from the banner that appears. It starts with
mora_.
The key is shown once. Mora stores only a hash of it, so it cannot be displayed again. If you lose it, revoke the key and create a new one.
Using a key
Pass the key as a bearer token in the Authorization header:
In Claude Code:
Reference an environment variable instead of pasting the key, so it stays out of your shell history and out of any config file you commit.
What a key can do
- A key is bound to the organization that was active when you created it, and it acts as you: your organization’s shared datasets and dashboards, plus your own private datasets.
- A key cannot sign in to the Mora web app, and it cannot read datasource credentials, billing, or member settings.
- Keys are rate limited to 120 requests per minute. Beyond that, calls are rejected until the next minute.
- Creating a key for an organization you are not a member of is rejected, and every request re-checks your membership.
Managing keys
Settings → API & MCP lists the keys created for the current organization.
- Rename: click the key’s name, edit it, and press Enter.
- Revoke: use the revoke action on the row. The key stops working immediately, and any agent using it loses access on its next call.
Keys have no expiry, so revoke the ones you no longer recognize. If a key may have leaked, revoke it and create a replacement rather than relying on the rate limit.
