API keys
Create and manage API keys, choose an expiry and scopes, and see why sending messages and liking posts need a separate grant.
Last updated 2026-10-23
An API key lets a script, an internal tool or an AI assistant call the REST API and MCP as your account. The key is shown once, when it is created; the server keeps only a hash. This page covers creating a key, what its scopes allow, which actions need a separate grant, and how to revoke it.
Where to find it
Open API Keys from the account menu in the bottom-left corner; the page title is API keys. The page describes itself as: Keys for the REST API and MCP, scoped to this account.
Create a key
- Choose Create key.
- Enter a Name. It appears in the list and can be up to 32 characters.
- Choose Expires: 30 days, 90 days, 1 year or No expiry. The default is 90 days; an expired key stops working.
- Review Scopes, described in the next section.
- Tick Allow outreach actions if this integration sends messages.
- Choose Create key.
- Copy the key in Copy your API key. This is the only time it is shown; once the dialog closes, the key can only be revoked and replaced. Choose Copy, store it safely, then choose Done.
A key is 64 letters with no fixed prefix. The list shows the first 6 characters followed by dots.
Scopes
The create dialog lists the scopes every key carries by default:
| Scope | Allows |
|---|---|
| Targets read & write | Read and change Targets, items, searches, enrichment columns, monitors and imports, and read the credit balance and jobs |
| Events read | Read the event list and single events |
| Webhooks write | Create, update and delete webhooks; reading webhooks uses Targets read & write |
The same key can also read company research reports, contacts and customs data, so the research, contacts and customs tools work in MCP without extra setup. Sending outreach is not part of the default set.
Outreach needs its own grant
A default key cannot send a message or like a post. Only after you tick Allow outreach actions does the key carry the outreach grant; the hint under it reads Send messages / like LinkedIn posts. Ticking it shows this warning: Anyone holding this key can send messages as your account. Only grant this to trusted integrations.
Even with the grant, the MCP tools can only send a single message to an existing conversation or an existing contact; there is no bulk sending. Every sent message is charged as Customer interaction, as described in How credits are charged.
Use the key
Either header works:
curl "https://www.renewsell.com/v1/targets" \
-H "x-api-key: $RENEWSELL_API_KEY"
curl "https://www.renewsell.com/v1/credits" \
-H "Authorization: Bearer $RENEWSELL_API_KEY"
The key acts as your account within the scopes above. If requests exceed the rate limit the API returns 429; wait for Retry-After and retry. See REST API overview.
Revoke and expiry
- Choose Revoke key in the list, confirm Revoke this API key?, then choose Revoke. Revocation is immediate, every request using the key starts failing, and the key cannot be restored.
- An expired key shows as Expired, and its requests fail the same way.
- The list shows Last used, or Never used. If something looks wrong, revoke first and create a new key.
FAQ
Where should the key live? In a server environment variable or a password manager. Never in browser code, a desktop bundle or a repository.
Can I share a key with a teammate? The key represents your account. Whoever holds it can do everything inside its scopes, including sending messages after the outreach grant.
Can a lost key be recovered? No. The server stores only a hash, so revoke it and create a new one.