# Create and revoke an access key

> An access key lets an app that cannot sign in through a browser use Prior's assistant address. How to create one, keep it safe and revoke it.

Source: https://priortasks.com/docs/integrations/access-keys/
Last updated: 2026-11-05

Most apps connect by sending you to your browser to sign in and click **Allow**: you need nothing else. An access key is for the apps that cannot do that, such as a script, a server, or an assistant that only accepts a fixed header. The key stands in for your sign-in.

Use the sign-in whenever the app offers it. It renews itself, so nothing expires on you.

## Create a key

1. Open **Settings → Integrations**.
2. In the **Claude Code** section, find **Access key**, type a name if you like (**Name of the key**), and click **Create access key**.
3. Prior shows a command under **Run this once in a terminal**, with a note that the key is shown only once. The key is the long text after `Bearer` in that command.
4. Copy the key now and store it in a password manager. Prior keeps only a hash of it, so it cannot show it again.

The command looks like this. It is only a convenient wrapper: the key works for any app that can send a header.

```
claude mcp add --transport http prior https://api.priortasks.com/mcp --header "Authorization: Bearer <key>"
```

## Use it

Send the key on every request to Prior's address:

```
Authorization: Bearer <your key>
```

The address is `https://api.priortasks.com/mcp`. In an app with a settings screen, put the address in the server field and the header in its "headers" or "custom headers" field. In a file that goes into a repository, never write the key. Read it from an environment variable instead. Claude Code, for example, can expand it in a `.mcp.json` file:

```json
{
  "mcpServers": {
    "prior": {
      "type": "http",
      "url": "https://api.priortasks.com/mcp",
      "headers": { "Authorization": "Bearer ${PRIOR_MCP_TOKEN}" }
    }
  }
}
```

Each person on the team creates their own key and sets `PRIOR_MCP_TOKEN` on their machine.

## How long it lasts

A key is valid for 365 days from the day you create it. After that it stops working and the app gets an error: create a new key and replace the old one. A key is not renewed by use.

## See your keys and revoke one

**Settings → Integrations** lists every connected app and key under **Connected apps**, with **Last used** and a **Revoke** button. Each key shows the name you gave it, or **Access key 1**, **Access key 2** and so on if you left it empty. Keys made before November 2026 are all called Claude Code: the **Last used** date tells them apart. That date is approximate: it is not refreshed on every request.

Click **Revoke** and the key stops working at once. Revoke a key as soon as you stop using the app, when someone leaves your team, or if you think it has leaked: see [Keep your AI connection safe](https://priortasks.com/docs/integrations/mcp-security/).

Changing your password also revokes every key and connected app.

## Good to know

- **A key does everything an assistant can do.** It is limited to Prior's assistant address and cannot reach your settings or create other keys, but inside the tools it can read and change your data. Treat it like a password.
- **Limits.** A key allows 120 requests a minute.
- **Browser sign-in is separate.** Apps connected through **Allow** are listed in the same place, and revoked the same way.