MCP keys allow AI agents and assistants to access your ShingleAI organization through the Model Context Protocol (MCP) . This guide covers creating, configuring, and securing your MCP keys.
MCP keys are separate from API keys. Use MCP keys for AI agent integrations (Claude, Cursor, etc.) and API keys for REST API access.
Prerequisites
You must be an Owner to manage MCP keys
Admins and Users cannot create, view, or revoke MCP keys
Creating an MCP Key To create a new MCP key:
Navigate to Settings > Security > MCP Keys
Click Create MCP Key
Enter a descriptive name (e.g., “Claude Desktop” or “Automation Agent”)
Configure resource permissions (see below)
Click Create
The full MCP key is displayed only once after creation. Copy it immediately and store it securely. You cannot retrieve the full key later.
ShingleAI MCP keys follow this format:
mcp_ - Indicates an MCP keylive_ - Environment (live for production)Followed by a unique identifier
Setting Permissions MCP keys support fine-grained permissions that control which tools are available to your AI agent.
Permission Structure Each permission specifies:
Component Description Example Resource What the key can access contacts, messagesAction What operations are allowed read, write, delete
When an AI agent connects with your MCP key, the server only registers tools that match the key’s permissions.
Available Resource Permissions Resource Actions Tools Affected contactsread, write, delete Contact management tools customersread, write, delete Customer and transaction tools businessesread, write, delete Business profile tools messagesread, write, delete Message reading and search tools automationsread, write, delete Automation workflow tools domainsread, write, delete Domain management tools tasksread, write, delete Task management tools filesread, write, delete File and folder tools
Permission Inheritance Permissions cascade to child resources. Granting access to a parent resource automatically includes its children:
contacts includes contacts.emails, contacts.phones, contacts.addressescustomers includes customers.transactionsbusinesses includes businesses.offerings, businesses.presence
A key with only read permission for contacts will have access to contact listing and search tools, but not tools that create or modify contacts.
Usage Limits Monthly Call Limits MCP calls are metered based on your subscription tier:
Tier MCP Calls/Month Free 500 Starter 5,000 Professional 50,000 Enterprise Unlimited
Limits reset on your billing cycle anniversary date. Paid tiers include a 10% grace period for overages before service is paused.
Rate Limits MCP connections are rate-limited to 100 requests per minute per MCP key. Exceeding this limit returns an error with a retryAfter value.
Monitoring Key Usage Track MCP key activity from the MCP Keys dashboard:
Metric Description Last Used Timestamp of the most recent connection Created When the key was created Status Active or Revoked Monthly Usage Calls used this billing period
Revoking Keys To revoke an MCP key:
Navigate to Settings > Security > MCP Keys
Find the key to revoke
Click Revoke
Confirm the action
Revoked keys cannot be restored. Any AI agent using the revoked key will immediately lose access.
When to Revoke Revoke MCP keys immediately when:
A key may have been compromised
An employee with key access leaves the organization
An AI integration is decommissioned
A key shows unexpected activity
Security Best Practices Key Storage
Never commit MCP keys to version controlUse environment variables or secret management services
Restrict file permissions on configuration files containing keys
Environment Variable
Claude Desktop Config
export SHINGLEAI_MCP_KEY = "mcp_live_abc123..."
Key Per Agent Create a dedicated MCP key for each AI assistant or automation. This makes it easy to:
Revoke access for a specific agent without affecting others
Track usage per integration
Apply different permission scopes to different agents
Principle of Least Privilege Grant only the permissions each agent needs:
Read-only keys for agents that only retrieve information
Resource-specific keys for focused integrations
Avoid granting delete permissions unless necessary
Audit Regularly Review your MCP keys monthly:
Remove unused keys (no activity in 90+ days)
Verify permissions match current requirements
Check for unexpected usage patterns
Troubleshooting Common Errors Error Cause Solution Invalid or missing MCP keyKey is incorrect, revoked, or missing Verify key value and status Insufficient permissionsKey lacks required resource/action Update key permissions or create new key Rate limit exceededToo many requests per minute Implement backoff in your agent Monthly limit exceededExhausted monthly call quota Wait for reset or upgrade plan
Next Steps 
