API Keys

API keys control access to your Sprigr Teams workspace through MCP. Each key is linked to the user who creates it and inherits that user’s permissions, giving you secure, role-based access from any MCP client.

Creating an API key

1. Navigate to the MCP page

   Sign in to team.sprigr.com and click MCP in the sidebar.

2. Click ”+ New Key”

   Click the + New Key button to open the key creation form.

3. Enter a key name

   Give the key a descriptive name that identifies its purpose, such as “Claude Code - Chris” or “Cursor IDE - Dev Team”. This helps you manage multiple keys later.

4. Choose permissions

   Choose the level of access this key should have:

   Permissions	Tools available	Description
   Read only	30 read tools	Can list agents, search knowledge, view workflows, check usage. Cannot send messages or make changes.
   Write only	74 write tools	Can send messages, create agents, manage workflows. Cannot read lists or search.
   Read & Write	All 104 tools	Full access to both read and write operations. This is the default and the most common choice.

5. Copy the key

   After clicking Create Key, the API key is displayed once, together with a ready-to-paste Quick Setup configuration snippet for Claude Desktop, Cursor, and VS Code. Copy the key immediately and store it securely - you will not be able to see the full key again. If you lose it, you will need to create a new one.

Try asking your agent

“Create a read-only MCP key called ‘Field Tablet’ for our technicians to search the knowledge base from their tablets.”

Your new key will appear in the API Keys table with its name, key prefix, scope, and last-used details.

User-level permissions

Every MCP key is linked to the user who created it. The key carries that user’s identity and role on every request:

• Owner/Admin users — Keys created by admins or owners see all conversations, all inbox threads, and all company data. They have the same unrestricted view as the portal dashboard.
• Member users — Keys created by members see their own conversations and the inbox threads they have access to. This is the same restriction they experience in the portal.

This is enforced automatically. You do not need to configure it - the platform looks up the creating user’s role on every request and applies the appropriate data filtering. A few sensitive tools, such as decide_mcp_write_approval, additionally require an owner or admin role.

Caution

A key’s permissions follow the user who created it. If that user’s role changes (e.g. promoted from member to admin), the key’s access updates automatically. If the user leaves the company, revoke their keys.

Connecting to MCP clients

The MCP server URL for your workspace is:

https://mcp.team.sprigr.com/mcp

Claude Code

Claude Code supports remote HTTP MCP servers natively. Add it with a single command:

claude mcp add --transport http "sprigr-hq" https://mcp.team.sprigr.com/mcp --header "Authorization: Bearer sk_mcp_YOUR_KEY_HERE"

Or add it to a .mcp.json file in your project root to share the configuration with your team:

{
  "mcpServers": {
    "sprigr-hq": {
      "type": "http",
      "url": "https://mcp.team.sprigr.com/mcp",
      "headers": {
        "Authorization": "Bearer sk_mcp_YOUR_KEY_HERE"
      }
    }
  }
}

The server will be available in your next Claude Code session. Every tool your key’s scope allows appears automatically.

Claude Desktop

Claude Desktop requires a stdio-to-HTTP bridge for remote MCP servers configured this way. Add the following to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "sprigr-hq": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.team.sprigr.com/mcp",
        "--header",
        "Authorization: Bearer sk_mcp_YOUR_KEY_HERE"
      ]
    }
  }
}

Tip

This uses the mcp-remote package to bridge Claude Desktop’s stdio transport to Sprigr’s HTTP transport. It installs automatically via npx on first run.

Restart Claude Desktop after saving. The server and its tools will appear in your next conversation.

Cursor, VS Code, and other clients

Add the following to your MCP client configuration. The transport type is Streamable HTTP.

{
  "mcpServers": {
    "sprigr-hq": {
      "url": "https://mcp.team.sprigr.com/mcp",
      "headers": {
        "Authorization": "Bearer sk_mcp_YOUR_KEY_HERE"
      }
    }
  }
}

Note

If your client only supports stdio-based MCP servers (like Claude Desktop), use the mcp-remote bridge shown in the Claude Desktop section above.

Managing API keys

The MCP page lists all active API keys for your organisation. For each key, the table shows:

• Name — The descriptive name you assigned
• Key — The key’s prefix (e.g. sk_mcp_a1b2c...), so you can match it to a configured client without exposing the secret
• Agent — “All agents”, or the specific agent a platform-minted key is scoped to
• Scope — Read only, Write only, or Read & Write
• Last Used — When the key last made a request
• Last IP — The IP address of the most recent request

Click any key row to expand its Recent Activity log: a per-event list showing the time, event type (Created, Used, New IP, Revoked), source IP, and which tool was called. Revoked keys move to a separate Revoked Keys section below the table.

Revoking a key

To revoke a key, click Revoke in its row on the MCP page and confirm. Revoking is immediate - any client using that key will lose access as soon as it is revoked. There is no way to reactivate a revoked key; you must create a new one.

There is no one-click rotate for MCP keys: to rotate, create a new key, update your clients, then revoke the old key.

Caution

Revoke a key immediately if you suspect it has been compromised. Keys grant direct access to your platform (scoped to the creating user’s permissions), so treat them with the same care as passwords.

IP tracking

Sprigr Teams records the source IP address of requests made with an API key. When a key is used from an IP address it has never used before:

• A New IP event is recorded in the key’s activity log on the MCP page.
• A security alert message is sent to your company’s agent chat, naming the key and the new IP, so you find out in real time — not at the next audit.

This helps you verify that keys are being used from expected locations and detect unexpected access quickly. If an alert was not you, revoke the key from the MCP page.

Agent-requested write access

Specialist agents running deep tasks sometimes need temporary write access to platform data (for example, to update the knowledge base as part of a job). Instead of holding a durable key, the agent files a write access request:

• Most requests are approved inline, via a card in the chat that asked for the work.
• Requests filed from surfaces with no chat card land on the portal Approvals page (and in list_mcp_write_approvals over MCP), where an owner or admin can approve or reject them.
• An approved request lets the agent mint a single-use, short-lived key, scoped to that agent, which expires automatically.

These platform-minted keys can briefly appear in your keys list with an agent in the Agent column. They expire on their own and need no manual cleanup.

Best practices

• One key per person or application — Create separate keys for each team member or tool that needs MCP access. This makes it easy to revoke access for a specific person or tool without affecting others.
• Use Read & Write for most cases — Most users need both read and write access. Reserve read-only keys for monitoring dashboards or automated reporting.
• Rotate keys periodically — Create a new key, update your clients, and revoke the old one, especially for keys used in shared environments.
• Watch the activity log — The per-key activity log shows exactly which tools each key is calling and from where. Investigate New IP events you do not recognise.
• Remember user binding — Each key is tied to the user who created it. If a team member leaves, revoke their keys.

Next steps

• MCP Overview — Learn how MCP works with Sprigr Teams, including the full list of 104 tools.
• Creating Agents — Create agents that MCP clients can interact with.
• Knowledge Bases — Set up knowledge bases that MCP clients can search.