Create and revoke an access key

An access key lets an app that cannot sign in through a browser use Prior's assistant address. How to create one, keep it safe and revoke it.

Most apps connect by sending you to your browser to sign in and click Allow: you need nothing else. An access key is for the apps that cannot do that, such as a script, a server, or an assistant that only accepts a fixed header. The key stands in for your sign-in.

Use the sign-in whenever the app offers it. It renews itself, so nothing expires on you.

#Create a key

The command looks like this. It is only a convenient wrapper: the key works for any app that can send a header.

claude mcp add --transport http prior https://api.priortasks.com/mcp --header "Authorization: Bearer <key>"

#Use it

Send the key on every request to Prior's address:

Authorization: Bearer <your key>

The address is https://api.priortasks.com/mcp. In an app with a settings screen, put the address in the server field and the header in its "headers" or "custom headers" field. In a file that goes into a repository, never write the key. Read it from an environment variable instead. Claude Code, for example, can expand it in a .mcp.json file:

{
  "mcpServers": {
    "prior": {
      "type": "http",
      "url": "https://api.priortasks.com/mcp",
      "headers": { "Authorization": "Bearer ${PRIOR_MCP_TOKEN}" }
    }
  }
}

Each person on the team creates their own key and sets PRIOR_MCP_TOKEN on their machine.

#How long it lasts

A key is valid for 365 days from the day you create it. After that it stops working and the app gets an error: create a new key and replace the old one. A key is not renewed by use.

#See your keys and revoke one

Settings → Integrations lists every connected app and key under Connected apps, with Last used and a Revoke button. Each key shows the name you gave it, or Access key 1, Access key 2 and so on if you left it empty. Keys made before November 2026 are all called Claude Code: the Last used date tells them apart. That date is approximate: it is not refreshed on every request.

Click Revoke and the key stops working at once. Revoke a key as soon as you stop using the app, when someone leaves your team, or if you think it has leaked: see Keep your AI connection safe.

Changing your password also revokes every key and connected app.

#Good to know

• A key does everything an assistant can do. It is limited to Prior's assistant address and cannot reach your settings or create other keys, but inside the tools it can read and change your data. Treat it like a password.
• Limits. A key allows 120 requests a minute.
• Browser sign-in is separate. Apps connected through Allow are listed in the same place, and revoked the same way.

Updated 5 November 2026