# Get your API key

Source: https://pushary.com/docs/agents/api-key
Last updated: 2026-10-18

> Find your Pushary API key, check what a valid key looks like, and replace or revoke one. The setup command creates and saves a key for you.

Your Pushary API key connects your AI agents to your Pushary account. You rarely need to copy it. The setup command creates a key when you pair your phone or sign in, and saves it on your computer. You only handle a key yourself when you connect a tool by hand, such as an MCP client, a REST call or a CI job.

```bash
npx pushary@latest setup
```

On Windows PowerShell, run `npx.cmd pushary@latest setup`.

## Copy a key from the dashboard [#copy-a-key-from-the-dashboard]

<Steps>
  <Step>
    Open **Settings > API keys** at [pushary.com/dashboard/agent/settings](https://pushary.com/dashboard/agent/settings).
  </Step>

  <Step>
    Click **Create Key** and give it a name you will recognise later, such as "Claude Code laptop".
  </Step>

  <Step>
    Copy the key and store it somewhere safe right away. The full key is shown only this once.
  </Step>
</Steps>

Keys made during web onboarding are named "MCP API Key" in the list.

## What a key looks like [#what-a-key-looks-like]

```text
pk_1a2b3c4d5e6f7a8b9c0d1e2f.3a4b5c6d7e8f...
```

A key is `pk_` plus 24 hex characters, a dot, then a 48 hex character secret. There is no `sk_` part. Examples in these docs write it as `pk_xxx.xxx`.

Treat the whole key as a password. Anyone who has it can send you notifications and ask you questions as your agent. A full-access key, such as one made with **Create Key** above, can also change your approval mode and push window, and accept suggested auto-approve rules. Do not commit a key to git or paste it anywhere public.

<Callout type="warn">
  Pushary stores only a hash of the secret, so nobody can show you a key again after it is created. If you lose a key, create a new one and revoke the old one.
</Callout>

## Use your key [#use-your-key]

Pass a key to the CLI instead of pairing:

```bash
npx pushary@latest setup --key pk_xxx.xxx
```

That puts the key in your process list. In CI, use `--key-stdin` so the key never appears in argv or shell history:

```bash
echo "$PUSHARY_API_KEY" | npx pushary@latest setup --key-stdin --yes
```

The CLI saves the key to `~/.pushary/config.json`. If `PUSHARY_API_KEY` is also set in your shell, the environment variable wins, and the CLI warns you when the two differ.

For MCP and REST connections, send the key as a Bearer token:

```text
Authorization: Bearer pk_xxx.xxx
```

## Replace a key [#replace-a-key]

Keys cannot be rotated in place. To replace one:

<Steps>
  <Step>
    Create a new key in **Settings > API keys**.
  </Step>

  <Step>
    Update each agent that uses the old key. Run `npx pushary@latest setup --key pk_xxx.xxx` with the new key, or paste it into your MCP config.
  </Step>

  <Step>
    Revoke the old key in **Settings > API keys**. It stops working right away, and revoking cannot be undone.
  </Step>
</Steps>

To revoke the key a machine uses from that machine, run:

```bash
npx pushary@latest sign-out --revoke
```

This revokes only a key the CLI created when you signed in with `login`, `setup` or the pairing QR. A key you passed with `--key`, or one the Mac app uses, is removed from the machine but stays valid, so revoke it in **Settings > API keys**.

You can keep several keys active at once. With one key per machine or per agent, you can cut off a single device without touching the rest.

## Next step [#next-step]

<Cards>
  <Card title="Connect any agent" description="Use your key with an MCP client, curl, n8n, Zapier or your own code." href="/docs/agents/connect-any-agent" />

  <Card title="Run the quickstart" description="Set up your agents and phone with one command. No key to copy." href="/docs/agents/quickstart" />
</Cards>