An API key lets a program do what you do in the app: read a model's results and launch runs. It identifies a team, not a person — which is why the API has no team in its URLs. The key says which team it belongs to.
Create one
Open meryn.ai/users/settings/teams/ — that is Settings →
Teams → your team in the app — and pick the API keys tab. Give the key a name and
a scope. The name is just so you can tell two keys apart later; the scope is what it is
allowed to do.
The tab has its own address, so you can bookmark it:
meryn.ai/users/settings/teams/<your-team>/#api-keys.
A key looks like this:
mk_a1b2c3d4e5f6_Xk9...
└─ prefix ─┘ └ secret ┘
The prefix is shown in the list from then on, so you can match a key in your config to a row on the screen. The secret is shown once, in the box right after you create it, and never again — we store only a hash of it. If you lose it, revoke the key and create another; there is nothing to recover.
Who can create one
| Create & revoke keys | See the key list | |
|---|---|---|
| Admin | ✓ | ✓ |
| Analyst | ✗ | ✓ |
A key is a credential for the whole team and it outlives the session that made it, so it sits on the same axis as the member list and the plan: admins only. An Analyst who needs one asks an admin of the team.
API access is part of the plan. Professional and Enterprise include it; Free does not. If your plan doesn't include it, the section says so and offers the upgrade — and a key issued before a downgrade stops working, because every request checks the plan.
The two scopes
They are a ladder, not a set — run includes everything read does.
read— projects, models, metrics, the readiness verdict, run logs, every chart dataset, and the budget allocator's output.run— all of the above, plus creating models and allocators and launching them.
There is deliberately no "write but not read" key: launching a run you cannot look at is not a thing anyone asked for.
⚠️ run costs real money. Each launch starts a container that runs for tens of
minutes and takes one of your plan's concurrent-run slots. Give a key read unless it
actually needs to launch.
Revoking
Revoke from the same screen. It takes effect on the next request — there is no cache to wait for.
Revoking does not delete the key's row, and that is on purpose: runs launched with it keep saying who issued them, which is exactly what you want when you have to audit who started what. A revoked key stays in the list with the date it was revoked.
⚠️ A key stops working when its creator leaves the team
Every request checks that the person who issued the key is still a member. So removing someone from the team closes their browser access and any key they created.
This is on purpose — without it, taking someone off a team would leave their programmatic access intact, which is the quieter half of an offboarding that looks finished. The practical consequence: if a key feeds something that has to keep running, create it from an account that will stay, not from a contractor's.
Where to go next
- Using the API — authentication, pagination, and how to read the numbers without getting them wrong.
- Connect Claude — point an assistant at your account.
- The full endpoint reference is at
/api/v1/docs/. It is generated from the API itself, so it cannot go stale, and you can try every call from there: hit Authorize, paste your key, and fire.
Takeaway: the secret is shown once and tied to the team, not to you — but it dies with its creator's membership, so issue long-lived keys from an account that will stay.