API Keys

Create and manage Runstack API keys for authenticating with the MCP server. Keys are workspace-scoped.

Source: https://runstack.engineer/docs/api-keys

API keys authenticate your requests to the Runstack MCP server at /mcp. Keys are created in the active workspace and stored with that workspace's ID — toolkit connections, guardrails, and tool execution all resolve against the workspace context.

Manage keys under Settings → Workspace → API Keys.

Plan limits

Plan	Executions per key
Free	50
Pro	Unlimited
Enterprise	Unlimited

A tool execution is counted each time execute_tool is called through the MCP server. search_tools, check_authentication, and initiate_connection do not count toward the limit.

Creating a key

Go to Settings → Workspace → API Keys
Enter a Name for the key (e.g. Claude Desktop, max 64 characters)
Click Create key
Copy the key now in the dialog — the full value is shown only once
Click Done

Keys are prefixed with rnsk_ followed by 64 hex characters.

Workspace scoping

When you create a key, it is bound to your active workspace. MCP clients should send the workspace header so execution uses the right toolkit connections and guardrails:

X-Workspace-Id: <workspace-id>

For the @rnsk/mcp package, set RUNSTACK_WORKSPACE_ID or RNSK_WORKSPACE_ID in your environment.

Workspace resolution priority for MCP requests:

X-Workspace-Id header (if you have access)
The API key's stored workspaceId (if you have access)
Your active workspace
Your first accessible workspace

Key security

Keys are stored as SHA-256 hashes — not in plain text
Only the first 12 characters (keyPrefix) are stored for display
If a key is compromised, delete it immediately and create a new one
Never commit keys to source control

Usage tracking

Each key tracks:

Field	Description
Usage	Progress bar — total `execute_tool` calls vs plan limit
Last used	Timestamp of most recent MCP request

The usage bar turns yellow at 80% of the limit and red at 100%. At the limit, the key is blocked until you upgrade or delete and recreate it.

View detailed request history in Settings → Workspace → Logs (Telemetry).

Deleting a key

Click the trash icon next to any key. Confirm in the Delete API key? dialog. Deletion is immediate — any client using that key receives 401 Unauthorized on its next request.

Multiple keys

Create as many keys as you need. Common patterns:

One key per MCP client (Claude Desktop, Cursor, custom scripts)
One key per workspace (different toolkit connections per project)
One key per environment (development, production)