An API key identifies the caller to the proxy. It decides which organization the traffic belongs to, which member it is attributed to, and which action and policies apply to it.
Create a key
Section titled “Create a key”- In the console, open Agents and choose New credential.
- Name the key after the client or the team that will use it, and optionally set an expiry.
- Choose whether its data is visible to the whole organization, and its default action: shadow (the default), logging or blocking. See what happens to a flagged request.
- Choose Generate. The key starts with
mlg_.
The key’s page then offers Connect, with ready-made configuration for each supported client and your key filled in: you can reopen it whenever you need the key again. Policies are attached on the same page; while one is attached, the policies decide instead of the default action.
Use one key per client
Section titled “Use one key per client”A key is the unit of attribution and policy. One key per tool, team or application keeps each one’s traffic, findings and enforcement apart, and lets you revoke one without touching the others.
Expiry and revocation
Section titled “Expiry and revocation”A key stops working when it expires, when it is revoked from its page in the console, or when the member who owns it leaves the organization or is deactivated. A revoked key is refused at once.
Keys are not interchangeable
Section titled “Keys are not interchangeable”API keys (mlg_…) authenticate the proxy. The model’s API takes its own
scanner keys (mgs_…), and the MCP server signs you in with OAuth instead of a key.