# Unkey MCP connector The Unkey connector lets Claude, ChatGPT, Cursor, and the Elaichi Agent create and manage API keys, identities, permissions, and deployments in Unkey as the signed-in person, with every action recorded in an audit log. Source: https://elaichi.ai/connectors/unkey/ ## Facts | | | | --- | --- | | Application | Unkey | | Category | Application Development | | AI tools | 47 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | No. 47 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` | ## What you can ask once Unkey is connected - List keys created for the Payments API this week. - Which identities have admin roles on production keys? - Show verification counts by API for the last 14 days. ## Connect Unkey in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Unkey. 2. Optionally set Share with, then press Connect. 3. Paste an Unkey API key. One person generates a token in Unkey and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Unkey tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Unkey to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Unkey to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Unkey to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Unkey to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Unkey tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Unkey through Elaichi ### Issue a key for a new customer Engineering. Ask for a new Unkey key tied to a customer's identity, with the right roles and permissions set from the start, without opening the dashboard. ### Look up a key a customer is asking about Support. Paste the key a customer sent in and get back which identity it belongs to, what it is allowed to do, and whether it still exists. ### Reroll a key that leaked Security. When a key shows up somewhere it should not, ask for it to be rerolled or deleted in Unkey right away, and confirm the old one is gone. ### Adjust roles and permissions in bulk Platform. Add, remove, or replace the roles and permissions on a set of Unkey keys when a plan changes or a feature moves tiers. ### See how often keys are being verified Product. Pull verification analytics from Unkey to find out which customers are actively calling your API and which have gone quiet. ### Keep customer identities up to date Customer Success. Update an identity's details in Unkey after a renewal or a name change, and list identities to check which accounts still have active keys. ## Frequently asked questions ### How do I connect Unkey to Claude? Connecting Unkey to Claude takes two steps. First, connect Unkey in Elaichi by pasting a root key from your Unkey dashboard, there is no OAuth application to register and no client ID or secret to generate. Then open Claude, go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp as the endpoint. Sign in with your Elaichi account and Unkey is available in Claude. ### Does Unkey work with ChatGPT and Cursor as well as Claude? Yes. Once Unkey is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Unkey once and every client picks it up, with the same access rules and the same audit log. ### What can an AI agent actually do with my Unkey data? An agent connected to Unkey can create, look up, reroll, migrate, and delete API keys, and add, remove, or set the roles and permissions on them. It can create and update identities, create APIs and deployments, list the keys under an API, and pull verification analytics to show who is calling your API. Because Unkey has many available actions, short concrete asks such as "reroll the key for Acme" work better than long paragraphs. ### Does connecting Unkey give the AI access to my whole workspace? No. The AI acts through the Unkey root key the connecting person pasted in, so it can only reach the APIs, keys, and identities that key already covers in Unkey. Elaichi can narrow that further, for example to read-only analytics for one team, but it can never widen access beyond what the person already has. ### Can my team share one Unkey connection? Yes. One person connects Unkey in Elaichi and shares the connection with a team, and nobody else ever handles the Unkey root key. Each teammate still signs in to Elaichi as themselves, so every key created, rerolled, or deleted in Unkey is logged under the name of the person who asked for it. ### Can I stop an agent from deleting or changing keys in Unkey? Yes. Restrictions in Elaichi work per action, so you can allow looking up Unkey keys and reading analytics while blocking deleting keys, deleting APIs, or changing permissions. A blocked action is never advertised to Claude, ChatGPT, or Cursor, so no prompt, however worded, can reach it. ### What happens to a Unkey connection when someone leaves? When a person is offboarded in Elaichi their access to Unkey through every client ends at once. If they had shared the Unkey connection with a team, it keeps working for everyone else on that team. Disconnecting Unkey in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client in one step. ## All 47 Unkey tools Every tool below is callable through https://api.elaichi.ai/mcp once Unkey is connected, subject to the toolbox it is in and the restrictions on the caller. - **Unkey analytics get verifications** (Get). Execute a SELECT SQL query against key verification analytics in Unkey. Returns a meta object with requestId and a data array of verification rows whose fields match your SQL SELECT clause. Only SELECT queries are allowed. Required: query. - **Create a Unkey API** (Create). Create a new API namespace in Unkey. Returns the created namespace's api_id and request metadata. Required: name. - **Delete a Unkey API by ID** (Delete). Delete an Unkey API namespace by id. Returns request metadata and an empty data object on success. Required: id. - **Get single Unkey API by ID** (Get). Get an Unkey API namespace by id. Returns the API namespace including id and name. Required: id. - **Unkey apis list keys** (List). List API keys for an Unkey API namespace. Returns: keyId, start, enabled, name, meta, createdAt, updatedAt, lastUsedAt, expires, permissions, roles, credits, identity, plaintext, ratelimits. Required: apiId. - **Create a Unkey deployment** (Create). Create a new deployment in Unkey from a pre-built Docker image. Returns the deployment id. Internal endpoint; not recommended for production use. Required: project, app, branch, environmentSlug, dockerImage. - **Get single Unkey deployment by ID** (Get). Get deployment information in Unkey including status, error messages, and deployment steps. Returns: meta, data, id. Internal endpoint; not recommended for production use. Required: id. - **Create a Unkey identity** (Create). Create an identity in Unkey to group API keys under a single entity with shared metadata and rate limits. Returns the created identity with id, externalId, meta, and ratelimits, plus request metadata. Required: externalId. - **Delete a Unkey identity by ID** (Delete). Permanently delete an identity in Unkey. This operation cannot be undone. Returns only the request metadata (requestId). Required: id. - **Get single Unkey identity by ID** (Get). Get an identity in Unkey by id. Returns the identity's id, externalId, meta, and ratelimits. Required: id. - **List all Unkey identities** (List). List identities in Unkey. Returns identities, a cursor, and a total count. Max 100 per page, defaults to 100. - **Update a Unkey identity by ID** (Update). Update an identity's metadata and rate limits in Unkey. Only specified fields are modified. Returns the updated identity's id, externalId, meta, and ratelimits. Required: id. - **Unkey keys add permissions** (Add). Add permissions to an Unkey key without replacing existing ones. Returns: id, name, slug, description. Required: keyId, permissions. - **Unkey keys add roles** (Add). Add roles to an Unkey key without replacing existing roles or permissions. Returns: id, name, description, permissions. Required: keyId, roles. - **Create a Unkey key** (Create). Create a new Unkey API key. Returns: meta, data. The plaintext key is returned only once. Required: apiId. - **Delete a Unkey key by ID** (Delete). Delete an Unkey key by keyId. Returns: meta, data. Defaults to soft deletion. Required: id. - **Get single Unkey key by ID** (Get). Get details of an Unkey key by id. Returns: meta, data. Required: id. - **Unkey keys get by hash** (Get). Look up an Unkey API key by its full key string. Returns meta and data; data contains the key record with keyId, enabled, name, permissions, roles, and credits. Required: key. - **Unkey keys migrate** (Action). Migrate pre-hashed API keys into an Unkey API. Returns meta and data; data contains the migration outcome with migrated entries (hash + keyId) and any failed hashes. Required: migrationId, apiId, keys. - **Unkey keys remove permissions** (Delete). Remove direct permissions from an Unkey key without affecting its roles. Returns meta and data; data lists the remaining direct permissions with id, name, slug, and description. Changes take up to 30 seconds to propagate. Required: keyId, permissions. - **Unkey keys remove roles** (Delete). Remove roles from an Unkey key without affecting its direct permissions. Returns meta and data; data lists the remaining roles with id, name, description, and permissions. Changes take up to 30 seconds to propagate. Required: keyId, roles. - **Unkey keys reroll** (Action). Generate a new Unkey API key while preserving an existing key's configuration. Returns meta and data; data contains the new keyId and key. Required: keyId, expiration. - **Unkey keys set permissions** (Set). Replace all direct permissions on an Unkey key in one atomic operation. Returns meta and data: the updated permission list in data, including each permission's id, name, slug, and description. Changes may take up to 30 seconds to propagate across all edge regions. Required: keyId, permissions. - **Unkey keys set roles** (Set). Replace all roles on an Unkey key in one atomic operation. Returns meta and data: the updated role list in data, including each role's id, name, description, and nested permissions. Changes may take up to 30 seconds to propagate across all edge regions. Required: keyId, roles. - **Unkey keys update credits** (Update). Update a Unkey key's credit balance. Returns meta and data: the updated credit balance in data, including remaining and refill settings. Provide value when incrementing or decrementing; set value to null for unlimited credits. Required: keyId, operation. - **Update a Unkey key by ID** (Update). Update an existing Unkey API key's settings. Supports partial updates such as name, metadata, expiration, credits, rate limits, roles, permissions, and enabled status. Returns meta and data: an empty data object confirming success. Changes take effect immediately but may take up to 30 seconds to propagate to all edge regions. Required: id. - **Unkey keys verify** (Verify). Verify an Unkey API key's validity, permissions, rate limits, and usage quota for request authentication. Returns meta and data: the verification result including valid, keyId, name, meta, expires, credits, enabled, permissions, roles, identity, and ratelimits. Always returns HTTP 200; check the valid field to determine authorization. Required: key. - **Unkey keys whoami** (Action). Get information about an Unkey API key by its full key string. Returns the key object under `data` including keyId, start, enabled, createdAt, permissions, roles, credits, and ratelimits. Required: key. - **List all Unkey liveness** (List). Check the health status of the Unkey API. Returns the service health object including requestId, message, and response metadata. No authentication required. - **Create a Unkey permission** (Create). Create a new permission in Unkey. Returns the response envelope with meta and data containing permissionId. Required: name, slug. - **Delete a Unkey permission by ID** (Delete). Delete a permission in Unkey by permission id or slug. Returns the response envelope with meta and an empty data object on success. Required: id. - **Get single Unkey permission by ID** (Get). Get a permission in Unkey by id or slug. Returns the response envelope with meta and data containing id, name, slug, and description. Required: id. - **List all Unkey permissions** (List). List all permissions in your Unkey workspace. Returns the response envelope with meta, an array of permission objects (id, name, slug, description), and pagination cursors. Optional: cursor, limit. - **Update a Unkey permission by ID** (Update). Update a permission in unkey. Returns: meta, data, name, email, plan. Required: id. - **Create a Unkey role** (Create). Create a new role in Unkey. Returns: meta, data. Required: name. - **Delete a Unkey role by ID** (Delete). Delete a role in Unkey by role id or name. Returns meta and an empty data object. Required: id. - **Get single Unkey role by ID** (Get). Get a role in Unkey by role id or name. Returns: meta, data. Required: id. - **List all Unkey roles** (List). List all roles in your Unkey workspace, including their assigned permissions. Returns: id, name, description, permissions. - **Update a Unkey role by ID** (Update). Update an existing RBAC role in Unkey. Returns the updated role including id, name, description, and permissions. Required: id. Provide at least one of name, description, or permissions to change. - **Unkey ratelimit limit** (Action). Apply a single rate limit check in Unkey for an identifier within a namespace. Returns the rate limit result in data, including limit, remaining, reset, and success, plus request metadata in meta. Cost defaults to 1. Required: namespace, duration, identifier, limit. - **Unkey ratelimit multi limit** (Action). Apply multiple rate limit checks in a single Unkey request. Returns the combined result in data, including a passed flag and per-check limits (limit, remaining, reset, success), plus request metadata in meta. - **Unkey ratelimit set override** (Set). Create or update a custom Unkey rate limit override for an identifier pattern. Returns the override_id in data and request metadata in meta. Required: namespace, duration, identifier, limit. - **Unkey ratelimit get override** (Get). Retrieve an existing Unkey rate limit override by namespace and identifier pattern. Returns the override configuration in data, including override_id, duration, identifier, and limit, plus request metadata in meta. Required: namespace, identifier. - **Unkey ratelimit delete override** (Delete). Delete an Unkey rate limit override by namespace and identifier pattern. Returns meta and an empty data object on success. Required: namespace, identifier. - **Unkey ratelimit list overrides** (List). List rate limit overrides in an Unkey namespace. Returns: overrideId, duration, identifier, limit. Required: namespace. - **Unkey portal create session** (Create). Create a short-lived Unkey Portal session for an end user. Returns the session id, redirect URL, and request metadata. Requires slug, externalId, and permissions. - **Unkey portal exchange session** (Action). Exchange a short-lived Unkey Portal session token for a long-lived browser session token. Returns the new token, its expiration timestamp, and request metadata. Requires sessionId.