API Keys Done Right: Generate, Expire, Rotate and Revoke

September 16, 2026

An API key is a password for your app. If it leaks, someone else spends your Makes. If it never expires, you forget it exists. If you cannot revoke it, you cannot fix a mistake. getqueryly treats keys like real credentials, not an afterthought, so you can ship integrations without worrying about the plumbing.

Where to Generate a Key

Sign in at getqueryly.com, open Settings, and scroll to API Keys. Click Generate. Pick a name like Default key or Production, and an expiry: 7 days, 30 days, 90 days, or never. The key is shown once with a Copy button. Copy it then, if you miss it, rotate to get a fresh one. The first key on a new account is named Default key automatically.

Keys are shown by name, prefix, and last four characters after creation, never the full value again, so a screen share does not leak the secret. If you need to see membership between clipboard and vault, the prefix plus last four is enough to match, and rotation is always available to get a new value.

One Header for Everything

Both the REST API and the MCP server at https://getqueryly.com/mcp/sse use one header:

X-API-Key: dmk_your_key_here

There is no separate MCP token. The same key unlocks upload, query, health, insights, swarm, chat, visuals, diagram, and web search, and every call spends from the same Makes pool as the web UI. If you ever need to debug, the prefix in Settings matches the prefix logged for each request.

Expiry, Rotate, Revoke, Delete

Expiry: Every key has an expiry you choose. Expired keys return 401 with an expired message, and the dashboard shows Expired. You can delete an expired key to clean up.
Rotate: Rotate replaces the secret in place. You get a new value shown once, the old one stops immediately, and the key keeps its name. Use this when a teammate leaves, a repo was pushed with a secret, or you just want a fresh copy.
Revoke then Delete: Revoke disables the key right away, apps using it start failing with 401, and the row shows Revoked and becomes deletable. Active keys need revoke first, so you cannot delete a live key by accident. Revoked and expired keys get a Delete button, active keys get Revoke.
Rename: Give keys real names. Empty names show as Default key so the list is always readable.

The flow is intentionally strict. A leaked key can be revoked in one click, a forgotten demo key expires on its own, and a compromised key can be rotated without creating a new row or changing permissions. For audits, an admin lookup by prefix can trace any key to its owner account.

How Many Keys Can You Have

Every tier includes keys, but caps keep usage honest: free 2 keys, starter 5, developer 10, business 25. The Settings counter shows keys used and limit, like 1 of 2, so you know before you click Generate. If you hit the cap, upgrade or delete an expired or revoked key to make room. Caps apply at generation, not at copy.

Per-Key Rate Limits

Rate limits are per key, not per account, so one noisy script cannot block the others. Regular endpoints allow 10 requests per minute on free, 30 on starter, 60 on developer, 120 on business. AI endpoints cost more compute, so they get half: 5, 15, 30, 60. Every keyed response includes X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Over the limit returns 429 with Retry-After and a plain wait message. See how to track Makes usage and avoid rate limits for a full walkthrough with curl.

What a Real Request Looks Like

# upload, then ask a question
curl -X POST https://getqueryly.com/api/data-scientist/upload \
  -H "X-API-Key: YOUR_API_KEY" -F "[email protected]"
# {"session_id":"ds_...","columns":[...],"rows":3200}

curl -X POST https://getqueryly.com/api/data-scientist/query \
  -H "X-API-Key: YOUR_API_KEY" -H "Content-Type: application/json" \
  -d '{"session_id":"ds_...","query":"what is revenue by region as a bar chart"}'

MCP in Cursor or VS Code is the same key, same header, one config block:

{
  "mcpServers": {
    "getqueryly": {
      "url": "https://getqueryly.com/mcp/sse",
      "headers": { "X-API-Key": "YOUR_API_KEY" }
    }
  }
}

Once added, say Analyze /tmp/sales.csv: what is my best product by revenue and the assistant calls upload then query for you.

Who This Helps

Developers shipping a reporting job that should not break when a key changes. Name keys per environment and rotate the staging one without touching production.
Founders handing off an integration to a contractor. Revoke that key when the contract ends, no code change needed.
Analysts pasting a key into a notebook. Give it a 7 day expiry so it cleans itself up after the deadline.

A key you can name, expire, rotate and revoke is a key you can trust with real workloads. Generate one in Settings, set an expiry, and keep shipping.

Costs to Remember

Uploading is free. A data question costs 1 Make, health check 2, insights 3, report 3, swarm 5 for quick or 8 for full, chat 1, visuals 2, diagram and infographic 1 each. Check live costs at GET /api/makes/costs and your balance at GET /api/makes/limits. Free accounts get 10 Makes per day, 2 without signing in, paid packs never expire and have no daily cap.

Want the full API shape? See api-docs and API data analysis guide. For programmatic AI tools, read how your AI assistant can actually do things.

Generate Your API Key