Skip to main content
API keys let your team interact with Odin programmatically — querying findings, assets, and pentests from scripts, CI pipelines, and AI agents like Cursor or Claude through the Odin MCP server. Open the API Keys page from Management > API Keys in the sidebar.
Only Admin and Owner roles can create or revoke API keys. Other members can’t see this page.

​
Creating an API key

1

Open the API Keys page

Go to Management > API Keys in the sidebar.
2

Click Create API Key

The creation dialog opens.
3

Name the key

Give the key a descriptive name (e.g. Cursor MCP, CI Findings Sync, Dashboard Export). The name is visible only to your team.
4

Choose permissions

Pick Read only for query-only access, or Read & Write to also allow mutations.
5

Copy the key

The full key is shown once and never displayed again. Copy it now and store it somewhere safe.
The raw API key is shown only once at creation time. If you lose it, revoke the key and create a new one.

​
Permissions

PermissionScope
Read onlyRead access to findings, assets, pentests, reports, and integrations
Read & WriteSame as read, plus mutation access (status changes, asset edits, etc.)
For most automation and AI-agent use cases, Read only is sufficient and recommended.

​
Revoking a key

To revoke a key, click the revoke action next to it in the table and confirm. Any integration using that key will stop working immediately. Revocation cannot be undone.

​
Connecting an AI agent (MCP)

The Odin MCP server lets AI agents query your organisation’s data through the Model Context Protocol. Once connected, you can ask agents like Cursor, Claude, or Codex questions like “What are my critical findings?” or “List recently discovered assets” and get live answers. Expand the Setup guide: connect an AI agent card on the API Keys page to see ready-to-paste configuration snippets for:
  • Cursor — add to .cursor/mcp.json or via Settings > MCP
  • Claude Desktop — add to claude_desktop_config.json
  • Claude Code — register from the terminal with claude mcp add
  • Codex — add to ~/.codex/config.toml
The snippets use the standard MCP stdio transport via npx @borgresearch/odin-mcp with your API key supplied as the ODIN_API_KEY environment variable.
After creating a key, the setup guide in the create dialog pre-fills the key into each snippet so you can paste it directly into your agent config.
For Windsurf, VS Code, Cline, and other MCP clients, see the Odin MCP package on npm for client-specific configuration.

​
Security notes

  • Treat API keys like passwords. Never commit them to source control or share them in chat.
  • Use one named key per integration or agent so you can revoke a single key if a machine or session is compromised.
  • Keys are scoped to a single organisation. They can’t access data from other organisations a key holder belongs to.