> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allocait.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Keys and apps

> How API keys and connected apps are stored, scoped and revoked.

An API key or a connected app reaches your account only within the access you gave it. This page covers each.

## API keys

Allocait generates every API key on its own servers and stores only a SHA-256 hash of it, never the key itself. Because only the hash is stored, a key can't be read back from the database. A key starts with `alc_`, which makes it easy to recognize, and you can set it to expire after 90 days or 1 year.

Each key has its own access, **Read only** or **Read and change**. You choose it when you create the key in **Settings > API keys**. See [Access levels](https://docs.allocait.app/concepts/access-levels.md).

When a key is read-only, the server refuses every write tool. If an account's access drops to read-only, its write keys work read-only.

A key shows **Inactive** in Settings when it has gone more than 30 days without use, counted from its creation if it was never used.

## Connected apps

When you connect an agent such as Claude by signing in through the connector, you choose what it may do:

* **Read only is the default, and it covers your whole account.** The app can see everything in it, not only portfolios.
* **Changes are your choice.** The app can add, change or delete data only if you choose **Read and change**.
* **Removal takes effect on the app's next request.** Remove an app in **Settings > Apps**. Anything it already changed or created stays.

A connected app doesn't get the access your browser session has. It reaches your account only through Allocait's MCP server, within what you allowed.

## Rate limits and account access

Agent requests are rate-limited per account; see [Rate limits](https://docs.allocait.app/api/rate-limits.md) for the budgets. Agent access depends on the account: some accounts read and check only, and others also change data and use webhooks. See [Access levels](https://docs.allocait.app/concepts/access-levels.md).

An account that can't use agent access gets one `403` text that says to manage the account in the Allocait app. A key that still exists stops working for new calls when the account loses access.

## Related

* [Authentication](https://docs.allocait.app/api/authentication.md): create a key and set its scope.
* [Security](https://docs.allocait.app/security-and-privacy.md): what Allocait does and never does with your data.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.