Connected apps and API keys
See and disconnect the AI apps connected to your workspace, and create API keys for servers and scripts.
Most AI apps connect by signing in, with no key needed. See Connect your AI app. You see those apps under Connected apps. An API key is for a server, a script or a CI run that can't sign in: a secret code that lets it act in your workspace.
You manage both in Settings → API & MCP. They work for the workspace selected there.
Connected apps
Every AI app connected to the workspace shows under Connected apps, with who connected it and whether it can only read or can also make changes.
- Disconnect an app: click Disconnect. It stops working right away. Members can disconnect their own apps, and admins can disconnect anyone's. Removing UniFeeds inside the app doesn't take it off this list, so disconnect it here too.
- Change what an app can do: sign in to UniFeeds again from the app and choose again. Any member can connect an app to read. Only admins can tick the option to allow changes. Your new choice replaces the old one right away, even in chats that are already open.
- Change workspace: sign in again from the app and pick the other workspace. Then disconnect the app from the old one.
- Added again: when you add a chat app such as Claude or ChatGPT again and sign in, its new entry replaces the old one. Terminal apps such as Claude Code, Codex, Hermes and OpenClaw get their own entry on each computer, so connecting a second computer doesn't sign out the first.
- Staying signed in: an app stays signed in while you use it. After 30 days without use, it asks you to sign in again.
When people leave or change role
- Someone who leaves the workspace loses their connected apps and API keys within a minute (in rare cases up to six hours).
- An admin who becomes a member keeps their connected apps, but within a minute (in rare cases up to six hours) those apps can only read and their API keys stop working.
- An admin opening Settings → API & MCP also checks for these changes, unless the workspace was checked in the last 10 minutes.
API keys
Only admins can create keys.
- Go to Settings → API & MCP.
- Click Create key.
- Give it a Name that says where you'll use it, such as
Hermes on my server. - Under Permissions, choose Read only or Read and write. Leave it read-only unless the AI should create, schedule, publish or delete posts, or import media.
- Under Expires after, choose 30 days, 90 days or 1 year.
- Click Create key.
- Copy the key and store it somewhere safe. It starts with
ufk_, and you only see it once.
Each app's guide shows where the key goes, under Use an API key instead. A workspace can have up to 25 active keys.
| Scope | What it allows | Tools |
|---|---|---|
social:read | See connected accounts, posts and their delivery status, the media library, and workspace and post analytics, and refresh post metrics. | list_accounts, list_posts, get_post, list_media, get_overview, get_post_analytics |
social:write | Create, edit, schedule, publish, retry and delete posts, remove published posts from platforms, and add images and videos to the media library from a URL. | create_post, update_post, reschedule_post, retry_failed_targets, delete_post, remove_from_platform, import_media_from_url |
- Change permissions: you can't change a key's permissions. Create a new key, then revoke the old one.
- Rotate a key (swap it for a new one): create a new key, update your app to use it, then revoke the old key.
- Revoke a key: click Revoke key. It stops working right away.
- Expired keys stop working on their expiry date.
- Old keys: revoked and expired keys stay listed for 30 days, then disappear.
Anyone with a key can act in your workspace. Keep keys in environment variables or a secret manager (a safe store for passwords and keys), never in code, chats or shared documents. If a key may have leaked, revoke it.
Limits
- Each sign-in or API key can send up to 120 requests a minute, and connect up to 20 times a minute. Over that, the app gets
429 Too many requestsand waits a minute. - Each sign-in or API key can make 30 calls a minute that publish, schedule, retry, add media or reach a platform. Calls that only read don't count. Over that, calls fail with
RATE_LIMITED. Wait a minute and try again.