Credentials
Creating, storing and revoking the API keys used for MCP and the REST API.
An API key is a password for programs. Whoever holds it can spend your account's balance, so treat it like a password: do not share it, and do not keep it in code other people can read.
Creating a key
Sign in to the studio and open Credentials in the Account group of the sidebar, or go straight to studio.xplor3.space/en/credentials.
Press New key, give it a name that says what it is for (for example "Cursor laptop" or "Catalogue bot"), then choose how long it lasts: 30, 90 or 365 days, or no expiry.
Copy the key. It starts with xpk_ and is shown only once. If you miss it, revoke that key and make a new one.
One account can hold up to 10 active keys at once.
Using a key
Send the key in the Authorization header of every request:
Authorization: Bearer xpk_your_keyThe same header is used for the MCP server and the REST API.
Storing it safely
- Keep it in an environment variable or a secret manager, not in code.
- Never use a key in code that runs in your users' browsers. Call XPlor3 from your own server or backend.
- Use one key per app or device, so if one leaks, the others keep working.
XPLOR3_API_KEY=xpk_your_keyRevoking a key
The Credentials page lists every active key with its name and when it was last used. Press Revoke on a key you no longer use or that may have leaked. A revoked key stops working at once and cannot be turned back on.