API keys

API keys are how agents authenticate to Billr. Every request an agent makes, over MCP or the REST API, runs under the scope of the key it presents.

Format

Keys look like this:

billr_sk_3f9a1c... (48 hex characters after the prefix)

We store only a hash of the key, never the raw value, so support and engineering can't read it back either.

Creating a key

Go to Settings → API in your dashboard and create a key. It's shown to you exactly once, at creation time. Copy it somewhere safe immediately. If you lose it, revoke it and create a new one; there is no way to view it again.

Business scoping

When you create a key, you choose whether it can act on a single business or all businesses in your account. If you run multiple brands, scope each agent's key to the one business it should touch. That way a misbehaving prompt in one repo can't reach invoices for a different business.

Revoking a key

Revoke any key from Settings → API at any time. Revocation is immediate. The next request made with that key is rejected. Revoked keys stay listed for your records, with their last-used time, but can't be reactivated.

Security note

Treat an API key like a password: don't paste it into shared chats, commit it to a repo, or hardcode it in a config that gets checked in. Create a separate key per agent or per machine so you can revoke one without disrupting the others, and scope each key to the narrowest business it actually needs.