Create an API key
Keep browser account controls separate from scoped personal bearer keys, and create only the access a script or MCP client needs.
Follow the steps
Sign in, open Settings → API keys, and choose Create API key.
Give the key a descriptive name, choose the smallest required non-empty set of scopes, and set an expiry. Valid scopes are boards:read, boards:write, library:read, and library:write. The browser extension needs library:write; add boards:write to capture to editable canvases.
Copy the raw rail_sk_ secret immediately. The create response shows the raw key once; later lists and account exports contain metadata only.
When a key is no longer needed, revoke it from Settings. Revocation takes effect immediately.
Choose only the access you need
Personal keys always expire: the default is 90 days and the maximum is 365 days. Choose a non-empty subset of the available scopes and revoke the key when the connection is finished.
| Scope | What it allows |
|---|---|
boards:write | Capture selected web content to editable canvases. Also requires library:write. |
boards:read | List and read canvases the account can view. |
library:read | List and search the account’s own library. |
library:write | Create, update and delete library items through REST. |
Code examples
Replace placeholders in your own protected environment. Never paste a real key into a public page, browser bundle, prompt, screenshot, issue or repository.
{
"name": "Research archive",
"scopes": ["boards:read", "library:read"],
"expiresAt": "2026-12-11T17:00:00.000Z"
}What to know
- The default key lifetime is 90 days and the maximum is 365 days. An account can have at most 20 unexpired, unrevoked keys, and key creation is rate limited.
- Personal keys authenticate only the /api/v1 REST routes and /mcp. They do not authenticate browser session, account, billing, admin, upload, job, or other ordinary /api routes.
- A revoked or expired key, or a key belonging to a disabled or deleted account, fails immediately. Personal keys do not use the OAuth resource audience.
Troubleshooting
- If the key is lost after the one-time response, create a replacement and revoke the old key. Rail Cove cannot display the raw secret again.
- If creation returns an invalid-scope error, remove wildcard or unknown scopes and choose a non-empty subset of the supported scopes.
- If the account has reached its active-key limit, revoke an unused key or wait for an existing key to expire before creating another.