Manage API Keys & MCP Connections

Q: Can an API key create or change data, or is it read-only?

Both are possible. Besides the read scopes (`*:read`, `mcp:read`), most data areas also have their own write scope (`*:write`), and MCP full access (`mcp:full`) grants full read and write access to the entire MCP tool catalog. Only if you select exclusively read scopes when creating the key will it be unable to create, modify, or delete any entries.

After reading this article you'll be able to create API keys for MCP clients such as Claude Desktop or Cursor, grant them the right read/write permissions, copy them, and revoke them when needed.

API keys let you connect external tools and AI assistants directly to your Univents workspace. The keys are used for MCP connections and external integrations, allowing programs like Claude Desktop or Cursor to access your events, documents, and production status on your behalf.

Where to find API keys

Click Integrations in the left main menu and select the API Keys tab. The page displays all existing keys along with the button to create new ones.

Creating a new API key

Click Create new key in the top right.
The Create new API key dialog opens. Enter a descriptive name in the Name field, for example Claude Desktop or n8n Workflow.
Under Permissions you'll see two columns, Read and Write, with one scope per data area (events, booking requests, booking orders & items, finance documents, contacts & companies, locations). Only mcp:read (AI / MCP access, read) is preselected — you can add or remove any read or write scope. At least one scope must stay selected.
Need full access to the entire MCP tool catalog (read and write, using your own permissions)? Enable MCP full access separately at the bottom. Univents shows a warning and requires an expiry date (max 1 year) — this scope never runs indefinitely.
Click Create.
The dialog switches to the API key created view. The full key is displayed once. Copy it now using the copy icon next to it.
Click Done to close the dialog.

The key then appears in the list with an Active badge and a prefix (e.g. uk_live_abc...).

Permissions (scopes) overview

Each scope covers one data area and is selectable as read or write independently — write does not automatically include read. If you want a tool to both read and edit an area, add both scopes.

Scope	Access	What it allows
`events:read`	Read	Query events
`events:write`	Write	Create, update, delete events
`booking-requests:read`	Read	Query booking requests
`booking-requests:write`	Write	Create and edit booking requests
`booking-orders:read`	Read	Query booking orders & items
`booking-orders:write`	Write	Create, update, delete booking order items; convert booking requests into orders
`finance-documents:read`	Read	Query finance documents & line items
`finance-documents:write`	Write	Create, update, delete finance document drafts (only while they haven't been sent or finalized)
`contacts:read`	Read	Query contacts & companies
`contacts:write`	Write	Create, update, delete contacts & companies
`locations:read`	Read	Query locations
`mcp:read`	Read	AI / MCP access, read-only
`mcp:full`	Read + Write	Full MCP tool catalog with your own permissions — requires an expiry date

MCP full access covers considerably more ground than the individual scopes above: the full tool catalog spans events, inquiries, schedules, and staff, through finance documents, supplier orders, contacts, contracts, and function sheets, all the way to inventory, tasks, reports, imports, translation, and recurring events.

Setting up the key in an MCP client

The generated key is stored in the respective tool as a bearer token or API key. The exact steps vary by application:

Claude Desktop: Open Settings, navigate to "MCP Servers", and add the Univents server with the key as the apiKey parameter.
Cursor: Enter the key in the MCP configuration area under "Tools & Integrations".
n8n / Make: Use the key in an HTTP node as an Authorization header in the format Bearer <key>.

Once the connection is established, the key list will show Last used: with the date of the most recent request for that entry.

Revoking or deleting a key

Both actions are available directly on each entry in the key list:

Revoke: Disables the key immediately. It remains visible in the list but receives a Revoked badge and can no longer be used for requests. Useful when you want to block a compromised key but still keep the name for tracking purposes.
Delete (trash icon): Removes the key entry completely from the list.

A revoked or deleted key stops working immediately. Connected MCP clients must be reconfigured with a new key.

Frequently asked questions

Can I view a key again after closing the dialog? No. The full key value is shown only once at creation time for security reasons. Afterwards only the prefix is visible in the list. If you have lost the key, simply create a new one and revoke the old one.

How many keys can I create? There is no fixed limit. Recommendation: one key per connected tool, so you can revoke individual connections as needed without disrupting others.

Can an API key create or change data, or is it read-only? Both are possible. Besides the read scopes (*:read, mcp:read), most data areas also have their own write scope (*:write), and MCP full access (mcp:full) grants full read and write access to the entire MCP tool catalog. Only if you select exclusively read scopes when creating the key will it be unable to create, modify, or delete any entries.

When should I revoke a key instead of deleting it? Revoke is the better choice when you want to quickly interrupt an active connection while keeping the entry as a reference. Delete makes sense when the key is no longer needed and you want to keep the list tidy.