# Keys & store access (https://sellersheetai.com/docs/mcp-api/keys)

> Sign in with OAuth where you can, use a key where you must — and decide exactly which stores and which actions each key may touch.



Most AI clients sign in in the browser and never show you a key. A key is for clients that can't open a browser (Coze, servers, headless agents) and for your own code.

## Two kinds of key [#two-kinds-of-key]

| Kind        | For                                                                           | Where it works                       |
| ----------- | ----------------------------------------------------------------------------- | ------------------------------------ |
| **MCP key** | AI clients — Claude, Cursor, ChatGPT, Coze and others                         | `https://sellersheetai.com/mcp` only |
| **API key** | Your own scripts and pages — the [Tool API](/docs/mcp-api/code), early access | the Tool API only                    |

An MCP key is refused by the Tool API, and an API key is refused by the MCP server, both with 401. Each browser sign-in creates an MCP key for that client, so it shows in the same list.

## Create a key [#create-a-key]

<Steps>
  <Step>
    ### Open the key list [#open-the-key-list]

    In the app: **Settings → API & MCP → Create key**.
  </Step>

  <Step>
    ### Name it after where it will live [#name-it-after-where-it-will-live]

    "Claude on my laptop", "VA agency", "reporting server". When a laptop is lost or a key leaks, the name tells you which one to turn off.
  </Step>

  <Step>
    ### Choose its reach [#choose-its-reach]

    **All my workspaces** reaches every store you reach in every workspace you belong to, stores shared with you included. **⟨workspace⟩ only** reaches that workspace's stores. Reach is fixed when the key is created — create a new key to change it.
  </Step>

  <Step>
    ### Choose its stores and access [#choose-its-stores-and-access]

    **Open** — every store the key reaches. **Restricted** — only the stores and marketplaces you list. For each, set **Seller API** and **Ads API** access: none, read, or read and write. A read key can analyse everything but cannot submit a feed, create a shipment or change a bid — useful as the everyday key, with a second write key you use on purpose.
  </Step>

  <Step>
    ### Copy it and connect [#copy-it-and-connect]

    Copy the token right away and keep it like a password — anyone holding it acts as you. **Snippets** on the key's row prints a ready-made configuration for each AI client with the key filled in. **Last used** tells you whether a key is still in use; turn a key off or delete it from the same list and every client using it stops at once.
  </Step>
</Steps>

Your plan sets how many keys of each kind you can have. A key never reaches beyond what you can reach yourself, and on a store shared with you it gets at most what the owner granted you.

## How your agent knows its own limits [#how-your-agent-knows-its-own-limits]

Every session starts with `get_user_context`. Its answer tells the agent which stores it can reach, with their `store_refs`, and what it may do on each — so it can tell you **before** it tries a change that would be refused.

## Keep keys out of sight [#keep-keys-out-of-sight]

* Keep a key in an environment variable (`SELLERSHEET_API_KEY`) or a `.env` file listed in `.gitignore` — never in code, a shared document or a command line.
* An agent that was handed a key in chat may write it to `.env` for you; it must not echo it back or commit it.
* Suspect a leak? Turn the key off in **Settings → API & MCP** and create a new one.

Related: [Store refs](/docs/mcp-api/store-refs) · [Stay in control](/docs/mcp-api/control) · [Troubleshooting](/help/troubleshooting/ai).