Skip to main content
Every request carries your API key. Cue accepts it either way, so use whichever your client reaches for:
Create and manage keys in the developer portal. A key is shown to you once, at the moment you create it. Copy it then. We store only a hash, so if you lose it, rotate or revoke it.
The same key authenticates the MCP server. Set it as a Bearer token in your agent’s config (no OAuth, no separate credential). That’s the header the MCP authorization spec uses, so most clients ask for it by default.

​
Keys and billing

Keys carry their mode in the prefix, so you always know which one you’re holding. Customer keys are always vbsk_live_. Test keys are an internal Vibeset tool, and the portal refuses to issue one to a customer account. A key needs either a card on file or a live credit grant. Each call runs real analysis against the licensed catalog, so it costs money to serve and is metered accordingly (see Metering & pricing). If we sent you a credit code, redeeming it stands in for the card while the grant lasts, and your account can hold two live keys until you add one. See Starting credits. Set a monthly spend cap in the portal if you want a hard ceiling while you build. Each key gets its own rate limit, 60 requests per minute by default. More keys means more concurrency, which is why a credit-funded account is capped at two of them.

​
Keep keys server-side

API keys are secrets. Call Cue from your backend, never from browser or mobile code where a key would be exposed. If a key leaks, revoke it in the portal. The instance that serves the revoke stops honouring the key at once, and other warm instances converge within the 30-second key-validation cache. Treat 30 seconds as the worst case, not the typical one.
Rotating a key issues a replacement immediately and schedules the old one to expire 24 hours later, so you can cut over without downtime. Rotation is not billing-gated, so a leaked key can be rolled even if billing has lapsed.