API Keys

FitRepo supports multiple named API keys stored in the mcp_api_keys table — one per client (e.g. claude.ai, Claude Desktop, my-script). Keys do not replace each other; each name is independent.

All key endpoints use Supabase session cookies (set by the web app login), not an API key itself.

---

List keys

GET /api/mcp/keys

Returns all active keys for the authenticated user. Raw key values are never returned — only metadata.

Response

{
  "keys": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "claude.ai",
      "created_at": "2026-05-01T10:00:00Z",
      "last_used_at": "2026-06-01T08:12:00Z"
    }
  ]
}

---

Generate a key

POST /api/mcp/keys
Content-Type: application/json

{ "name": "claude.ai" }

name is optional (defaults to "manual"). If a key with the same name already exists for this user, it is replaced — the previous key with that name stops working immediately.

Response

{
  "key": "a3f8c2...64 hex chars...",
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "claude.ai"
}

The raw key is returned once only — FitRepo stores only the SHA-256 hash. Store the key securely before leaving this page.

---

Revoke a key

DELETE /api/mcp/keys?id=<uuid>

Removes the key with the given id. Any client using that key immediately receives 401 errors.

Response

{ "ok": true }

---

Notes

• Keys are scoped per user — you cannot use one user’s key to access another’s data.
• Key names are limited to 60 characters.
• Revoking by id lets you revoke individual keys without affecting others.