API keys
Keys are for CI and for clients that cannot sign in through a browser. How to create one, how it is stored and how to revoke it.
You do not need a key for Claude, Cursor, Lovable or ChatGPT: they sign in through the browser. Keys are for scripts, CI jobs and clients with no browser.
Create one
Open Agents & API, type a label (for example “CI deploy”) and press Create key. The key is shown once, so copy it now. It looks like sbe_ak_<id>_<secret>. TileSet stores only a hash of the secret, so it cannot show it again. Lose it and you create a new one.
Use it
Send it as Authorization: Bearer <key> on requests to the REST API or the MCP server. Managing keys, exporting your data and deleting the account need a dashboard sign-in, not a key. Keep it out of site code and out of any page: the widget on your page never needs a key.
What a key can read
A key sets up and runs widgets. It never reads your content: for a source it gets counts, such as how many items it holds, their star ratings and how many have photos, never the posts or reviews themselves. If a source fails, a key gets a fixed sentence, not the platform’s own answer. To see a widget, open https://app.tileset.com/preview/<widgetId>: the widget as visitors see it.
Revoke it
The list on Agents & API shows each key’s label, a masked form and when it was created. Revoke is a two-step button and takes effect at once. Agents connected through the browser sign-in get a key too, named after the app (with “OAuth”); revoking it disconnects that agent.
Limits
- Up to 20 active keys per account, counting the keys of agents connected through the browser. Revoke one to add another.
- Keys you create do not expire; revoking is how they end. An agent connected through the browser is disconnected after 90 days unused, and asks you to approve it again the next time you use it.
- A leaked key can reach your widgets and sources, never your platform tokens. Revoke it and make a new one.