Authenticate Agents and MCP Clients with API Keys

Starting in Strategy (October 2026) and September Patch 1, AI agents, automation scripts, and Model Context Protocol (MCP) clients can authenticate to Strategy with an API key instead of an interactive browser login.

Prior to this update, connecting to the Strategy MCP server required users to sign in using a browser with OAuth. That pattern limits agents that run unattended in background pipelines. With API key authentication, a user creates the key once, and the agent then authenticates on its own for as long as the key is valid.

API key authentication does not change existing login flows. Standard, LDAP, SAML, OIDC, and OAuth logins continue to work as before.

See the following sections on API key authentication:

How API Key Authentication Works

  • An API key belongs to a single Strategy user and has exactly the same privileges as that user. Everything an agent does with the key runs as that user.

  • Each user can have one API key at a time. To give several agents separate permissions, create a separate user (service account) for each agent.

  • The MCP client sends the key with each request. The MCP server uses the key to sign in to Library on the user's behalf and creates a normal session, without a browser redirect or sign-in prompt.

  • The user's privileges, security roles, ACLs, and security filters apply to every request. API keys do not use scopes.

  • Each key has an expiration date. Administrators set the maximum lifetime allowed in the environment.

  • When a key is revoked or expires, it can no longer be used to sign in, and sessions created with it end.

  • Sessions created through the MCP server are recorded with the MCP application type, so you can tell agent activity apart from human activity in monitoring and Platform Analytics.

When to Use API Keys

Method Best Used For Is human sign-in required?
OAuth 2.0 (existing) Interactive MCP clients where each user signs in with their own identity, such as Claude, ChatGPT, or VS Code Copilot. Yes, when the connection is created and when the refresh token expires.
API key Headless agents, scheduled automations, and agent platforms that run without a user present, and scripts that call the Library REST API. Only once, to create the key.

Prerequisites

Privileges

Actions Required Privileges
Create, view, and revoke your own API key Generate API token
Manage API keys for other users, such as service accounts Administrator access in Workstation. The Allow users to create API tokens for other users environment setting controls whether this is allowed. Create and edit users and groups privilege
Enable or disable API token authentication Library administration access in Workstation. System administrative privilege
Set the maximum API key lifetime Configure security settings
Use the Agent MCP server Use Agent MCP Server and Run AI Bots, assigned to the user the key belongs to
Use the Mosaic MCP server Use Mosaic MCP Server, assigned to the user the key belongs to

The same content requirements apply as for OAuth connections: agents must be certified and added to the user's Library, and Mosaic models and cubes must be certified (and, for cubes, enabled for AI). For more information, see Connect a Client Using an MCP Server.

Enable API Token Authentication

API token authentication is controlled by a separate on/off switch in the Library authentication settings. It is off by default. Users need to enable it on demand.

  1. Open the Workstation.
  2. In the Navigation pane, click Environment Settings.
  3. In the Environment tab, click Library.
  4. Under Authentication Modes, turn on API Token Authentication.

  5. Click Save.

    The change takes effect in about one minute, without restarting Library. API token authentication is not a sign-in option for users. Therefore, it does not display on the Library sign-in page and cannot be the default authentication mode. If you turn off the setting, new API key logins are blocked but existing sessions do not end.

Set the Maximum API Key Lifetime

Administrators control how long API keys can remain valid with the Maximum API Token Lifetime (minutes) server setting.

  1. Open the Workstation.
  2. In the Navigation pane, click Environment Settings and All Settings.
  3. Open the server settings for your environment and locate Maximum API Token Lifetime (minutes).
  4. Type a value between 1 and 525600 (one year), or type -1 to use the default behavior.
  5. Click OK.

You can also change this setting with the Admin REST API or Command Manager.

Setting value Behavior
-1 (default) The maximum lifetime comes from the APITOKENLIFETIMEINMINUTES metadata property. If that property is not set, the maximum is 43,200 minutes (30 days). Existing environments keep their current behavior after upgrading.
1 to 525600 The setting value is the maximum lifetime. The APITOKENLIFETIMEINMINUTES metadata property is ignored.

When you create a key, you can request a shorter lifetime. If you do not specify one, the key receives the maximum lifetime. For example, if you request the following lifetimes, and the maximum is set to 5 days or 180 days, the following behavior is observed:

Requested lifetime Maximum = 5 days Maximum = 180 days
Not specified 5 days 180 days
5 days 5 days 5 days
10 days Rejected (400 Bad Request) 10 days

A request for a lifetime longer than the maximum is rejected; it is not shortened to the maximum. Updating the setting affects only keys created after the setting is updated.

Create an API Key

Strategy recommends creating a dedicated user (service account) for each agent and creating the key for that user. These actions ensures each agent's permissions are separate and makes its activity easy to identify.

Create Your Own API Key in Library

  1. Sign in to Library.
  2. Open the account menu and click API token.
  3. Choose an expiration for the key. The panel displays the calculated expiration date.
  4. Click Generate API token.
  5. Copy the key and store it in a secure location, such as a secrets manager.
  6. Click I've saved the token.

The key displays only once. After you close the dialog, it cannot be viewed or recovered. If you lose the key, revoke it and create a new one.

The API token panel shows the key's status, creation time, expiration time, and creator. If your key has expired, click Remove expired token before creating a new one.

API Keys Management For Other Users

Administrators can create, refresh, revoke and replace API keys for other users, such as service accounts, in Workstation. For more information, see Create an API Key for Another User.

Audit Agent Activity

Sessions created through the MCP server, with either OAuth or an API key, use their own application type:

Connection Application type
Agent MCP server MCP (97)
Mosaic MCP server USL MCP (81)

  • In Workstation, Monitor > User Connections displays MCP as the source of these connections.

  • In Platform Analytics, the sessions display with the MCP session source, so agent activity can be analyzed separately from human activity.

  • Because each key belongs to a user, filtering by that service account displays every action a given agent has done.

Best Practices

  • Create one service account per agent and only assign the account the privileges and content access the agent needs.
  • Use the shortest key lifetime for your replacement process.
  • Store keys in a secrets manager. Never put keys in source code, client-side code, or shared documents.
  • Revoke a key immediately if you suspect it has been exposed.
  • Review agent activity in Platform Analytics regularly.

Known Limitations

  • Each user can have only one API key at a time. There is no atomic key rotation.
  • The maximum key lifetime is one year (525,600 minutes).
  • API keys do not support scopes. A key always has the full privileges of its user.
  • API keys are for agents, MCP clients, and scripts. They cannot be used to sign in to Library, Workstation, or Web as a user.
  • Turning off API token authentication blocks new logins but does not end sessions that are already open. To end them, revoke the keys.