> ## Documentation Index
> Fetch the complete documentation index at: https://help.zarms.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect with an API key

> How to issue a team API key and use ZARMS through MCP or the REST API. Key permissions, expiry, and how to revoke a key.

When you use ZARMS from somewhere you can't sign in with OAuth, such as a Cursor settings file, your own scripts, or CI, use a team **API key**. The same key works for both MCP (`https://app.zarms.cloud/mcp`) and the REST API (`https://app.zarms.cloud/api/v1`).

Who can do this: Owner, Manager (issue and revoke)

## Issue a key

**1. Open the API key screen**

In the right-hand navigation, open **Settings** → **MCP connections** and click **API key
connections (alternate method)**.

**2. Set a name and permissions**

Click **Issue a new key** and enter a **Name** that tells you what the key is for. Under
**Permissions (scopes)**, choose **Read only** if you only need to read, or **Read and write**
if you'll also create or update cards. You can also choose read and update access item by item.

**3. Set the expiry and issue**

Choose an expiry from **No expiry**, **30 days**, **90 days**, or **1 year**, then click
**Issue**.

**4. Save the key**

Copy the key that appears (a string starting with `zarms_sk_`) and keep it somewhere safe.

> [!WARNING]
>
> The key is shown only once, right after you issue it. If you didn't save it, revoke that key and
> issue a new one.

Anyone who has the key can act with that key's permissions. Give each key only the permissions it needs, and use a separate key for each purpose. That way, if a key leaks, the damage is smaller.

## Use a key

Add the key to your request headers like this:

```text theme={null}
Authorization: Bearer zarms_sk_...
```

For how to set it up in Cursor, see [Connect from Cursor](https://help.zarms.cloud/en/mcp/connect-cursor.md).

For the REST API endpoints and the list of tools available over MCP, see the [ZARMS API documentation](https://app.zarms.cloud/api-docs).

## Revoke a key

Revoke keys you no longer use, or that may have leaked, on the API key screen. A revoked key stops working right away.

## How it differs from OAuth

| | OAuth | API key |
| - | - | - |
| Best for | Apps such as Claude and ChatGPT | Settings files, scripts, CI |
| Who can use it | Only the person who connected | Anyone who has the key |
| Choosing a team | You choose when you connect | Fixed to the team it was issued for |
| How to stop it | Disconnect in **Settings** → **MCP connections** | Revoke the key |

Assigning which boards a member can open as a Guest (`members:write`) is included in newly issued "Read and write" keys and newly approved "Read and write" OAuth connections. Keys and connections from before don't include it, so issue a new key or reconnect if you need it.

## Troubleshooting

* **You see "Basic does not include API or MCP. Upgrade to Starter or higher."**: The API and MCP are available during the trial or on Starter or a higher plan (see [Plans and trial](https://help.zarms.cloud/en/billing/plans.md)).
* **There's no button to issue a key on the API key screen**: Only Owners and Managers can issue keys.
* **Calls with the key return an error**: Check that the key hasn't been revoked or expired, and that it has the permissions you need.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.