API keys

An API key is how a program proves it is you. One key works everywhere outside the browser: the MCP server for AI clients, and the command line.

Create a key

Open Settings, then API, MCP and CLI. Give the key a name that says where it will live, “Claude on the laptop” for example, and press Create key.

The key is shown once, right after it is created. Copy it then and keep it somewhere safe. It is stored hashed on our side, so nobody, including us, can show it to you again. Lost a key? Revoke it and create another.

What a key can do

A key carries the same access to your account as you have in the browser: it can read and change tasks, projects, lists, notes, habits and calendar events. Every tool it opens, with the parameters each one takes, is listed in the API reference.

Narrower keys, read only for example, do not exist yet. Until they do, treat a key like a password:

• One key per tool, so you can cut off one tool without breaking the rest.
• Never paste a key into a shared document, a chat or a public repository.
• Revoke a key you no longer use.

Revoke a key

In the same settings panel, press Revoke next to the key. It stops working immediately, and every client using it starts getting an authentication error.

The row stays in the list, marked as revoked, so the history of what existed is not lost. Revoking does not touch your data.

Where a key is used

• AI clients send it to the MCP server in an Authorization header, usually set up once in the client config. See MCP server.
• The CLI stores it in ~/.config/todowl/config.json with owner-only permissions after you run todowl auth login or todowl auth token. See Command line.