API keys let you authenticate with PickFu programmatically. Use them with the MCP server, CLI, REST API, and custom automation scripts.
When to use API keys
API keys are ideal when you need:
Non-interactive authentication — CI/CD pipelines, cron jobs, or server-side scripts that run without a browser
Persistent access — API keys don't expire like OAuth sessions, so they're reliable for long-running automations
Simplicity — pass a single token instead of going through the OAuth flow
If you're using PickFu interactively from an AI assistant like Claude Desktop or Cursor, the built-in OAuth flow may be more convenient — but API keys work there too.
Creating an API key
Log in to PickFu and go to Settings > API Keys
Click Create API Key
Give the key a descriptive name (e.g., "CI pipeline" or "MCP server")
Copy the key value immediately — it is only displayed once and cannot be retrieved later
Keeping your keys secure
Store keys securely. Use environment variables or a secrets manager — never commit API keys to source control
Create separate keys for different uses. If one key is compromised, you can revoke it without affecting your other integrations
Delete compromised keys immediately. Go to Settings > API Keys and delete the key, then create a replacement
Review keys periodically. Remove keys you no longer use
Where to use API keys
Pass your API key as a Bearer token in the Authorization header:
Authorization: Bearer your-api-key-here
API keys work with all PickFu developer tools:
MCP server — add the key to your MCP client's headers configuration
CLI — pass the key during authentication setup
REST API — include the header in every API request
For detailed setup instructions for each tool, see the authentication documentation.