Skip to main content
A personal API key is a full-access credential for the CLI, direct HTTP API, and the SandyWP Cloner plugin. Use scoped OAuth rather than a personal key when connecting an MCP client to the product MCP at https://app.sandywp.com/mcp. https://docs.sandywp.com/mcp is Mintlify docs search only. The API keys section in the account dialog

​
Create a key

1

Open API keys

Open the profile menu, select Account, and then choose the API keys tab.
2

Label and generate

Add an optional label such as ci-pipeline, then select Generate key.
3

Store it safely

Copy the key immediately. SandyWP shows the plaintext key once and cannot show it again later.
Use it as a bearer token.
Do not commit a key, paste it into public chat, or reuse one key across unrelated tools. A personal API key has full account access.

​
Revoke a key

Select Revoke next to a key in the API keys tab. It stops working immediately. The list shows the label, creation time, and last-used time. Create separate keys per environment so one key can be revoked without interrupting another workflow.

​
MCP connections are different

An MCP client uses a browser-approved, scoped OAuth connection. Its token may call GET /api/account/me and the Imports family with the documented import:read or import:write scopes, but other generated REST operations do not accept it. The connection is tied to the workspace picked on the consent screen, so a team member can connect Claude or ChatGPT to a team workspace without sending any header. See OAuth connector flow. A personal API key acts in the workspace that was active when you created it. Send X-SandyWP-Workspace to switch it to another workspace you belong to, which is what sandywp workspace use does. Use the CLI for common automation, or start with the API Reference overview when you need direct HTTP requests.