Create and use API keys

API keys are intended for automation and controlled integrations. They do not replace browser sign-in and cannot directly access a desktop-local knowledge base. Use MCP pairing for local desktop Agents.

Create a key

Open “Account & connections → API & MCP,” enter a purpose, choose scopes, and set an expiration. The complete secret is shown once. Weave stores only its SHA-256 digest and cannot recover the original secret.

Current scopes:

• account:read reads a non-sensitive account summary.
• knowledge:read lists cloud knowledge-base metadata without document content.

Call the API

Send the key as a Bearer credential:

curl https://api.longde.cloud/api/integrations/api-access/me \
  -H "Authorization: Bearer weave_live_REPLACE_ONCE"

The knowledge-base metadata endpoint is:

GET /api/integrations/api-access/knowledge-bases

A key without the required scope receives 403. An expired or revoked key, or one owned by an inactive account, receives 401.

Security guidance

• Never commit a key to Git or embed it in documentation or distributed clients.
• Create a separate key for each system and grant the minimum scopes.
• Revoke a suspected key immediately from the account workspace; revocation takes effect at once.
• The Web displays prefix, scopes, expiration, and last use, but never displays the secret again.