# API keys

> Create, use and revoke Ghost API keys for Claude Code, scripts and automation tools that connect to the Ghost MCP server without OAuth.

Source: https://www.growwithghost.io/docs/api/api-keys/

API keys let tools that can't do an OAuth sign-in, such as scripts, servers and some MCP clients, connect to the [Ghost MCP server](https://www.growwithghost.io/docs/api/mcp-server). For Claude Desktop, ChatGPT and other apps with an "Add connector" button, use OAuth instead.

## Create a key

1. Go to **Settings → API** and click **Create API Key**.
2. Give it a label, such as "Claude Code – laptop".
3. Click **Create**, then copy the key and store it somewhere safe.

Keys start with `gwg_`. They don't expire, and they have full access to your account, so treat them like a password.

## Use a key

Send it in the `x-api-key` header:

```
x-api-key: gwg_xxxxxxxxxxxxxxxxxxxx
```

`Authorization: Bearer gwg_...` also works.

## Manage keys

**Settings → API** lists each key with its label, its last characters and when it was last used. Click a key to see ready-made setup snippets. Click the bin icon to revoke it: this happens immediately, without a confirmation step, and any client using the key stops working on its next request.

## Limits

There's no separate rate limit on the API, but everything it does counts toward your normal limits:

- **LinkedIn actions** follow the same [daily limits](https://www.growwithghost.io/docs/outbound/limits-and-safety) as the app.
- **Emails** follow your mailbox's sending limits.
- **People search and enrichment** use [credits](https://www.growwithghost.io/docs/find/credits).

## Keep keys safe

- Treat a key like a password. It can do anything you can do in Ghost.
- Use one key per tool or machine, so you can revoke one without breaking the others.
- Never commit keys to git. Use environment variables or a secrets manager.
- If a key leaks, revoke it in **Settings → API** and create a new one.