Skip to main content
An API key lets the local package, CI or another tool connect without a browser sign-in. It acts as you, in one workspace, with the permissions you pick. The same key also works as a bearer token on the hosted server.

​
Create an API key

1

Open API keys

Go to Settings > Integrations > API keys. Check the workspace selector at the top: a key belongs to one workspace.
2

Choose Create key

The page lists your keys and, under Connected AI apps, every tool you connected with sign-in.
3

Name the key

Name it after where it will run, for example “Cursor on my laptop”, so you know which one to revoke later.
4

Tick the permissions it needs

The form opens with five ticked: Read workspace, Read projects, Read comments, Edit comments and Import findings. That is enough to read and work on comments and to import your own findings. Leave the write permissions out for a key that should only read. See what each permission allows.
5

Pick when it expires

Never, 30 days or 90 days. Then choose Create key.
6

Copy the key now

It starts with sf_pat_ and is shown only once. Superflow keeps only a fingerprint of it. Closing the panel with Done hides the key for good.
7

Copy the setup snippet

Under Set it up, pick Claude Code, Claude Desktop or Cursor and copy the snippet. Your key is already in it.

​
What each permission allows

These are the 16 checkboxes on the form, and the consent screen uses the same names. A tool whose permission is missing answers with a clear “forbidden” message that names what it needs. The tool reference shows which permission each tool needs.

​
Good starting sets

Read only

Read workspace, Read projects, Read comments, Read agents, Read analytics, Read integrations. Good for reports and questions.

Work on comments

Read workspace, Read projects, Read comments, Edit comments. Good for triage, replies and resolving.

Run reviews

Add Read agents and Run agents. Runs spend AI credits, and the assistant always shows the estimate first.

Hand off work

Add Read integrations and Use integrations to push comments to Jira, Asana, ClickUp or Monday and post to Slack.

​
Manage and revoke access

  • See every connection. Settings > Integrations > API keys lists your API keys and, under Connected AI apps, every tool you connected with sign-in, with its permissions and when it was last used.
  • Revoke. Choose Revoke next to a key or app and confirm. Anything using it stops working at once. You can also disconnect from your AI tool’s own connector settings, or run npx -y @usesuperflow/mcp logout for a package sign-in.
  • Change permissions. A key’s or sign-in’s permissions cannot be widened later. Create a new key, or connect again and approve the new list, then revoke the old one.
Removing Superflow from an AI tool’s config stops it calling the server, but does not revoke the access that tool already holds. Revoke it in Superflow too.