Authentication

Create an API key

An organization admin creates keys in Settings → Integrations. Only APIs your organization can access are offered. Alpha access is granted to an organization separately from its plan.

1. Select Create API key, enter a name that identifies the application, and choose an expiry.
2. New keys start with no app access. Choose Off, Read, Read & write, or Custom for each offered app. Review the individual permissions before allowing changes.
3. Choose the lookup tables, Duplicate Detection objects, and Attio workflows it can use, as applicable.
4. Check the permissions and resource selection on the create page, then select Create API key.
5. Copy the key when it is shown. It is shown once. Save it in your server's environment or secrets manager.

The create flow includes a sample request. Use the key's Playground to inspect responses. Never paste the key into a conversation or commit it to source control.

Send a REST request

curl 'https://api.neondeerdata.com/v1/self' \
  -H "Authorization: Bearer $NEON_DEER_API_KEY"

GET /v1/self identifies the key and organization and describes its access. Check the organization before writing. The Who am I reference lists the response fields.

Keys authenticate an integration with one organization. They are separate from your personal Attio sign-in. A key does not gain access to every resource just because the organization has installed an app.

Choose access

Row reads and writes, table settings, scans, AI assessments, merges, scheduling, and organization settings have separate permissions. Operations can require more than one permission. The permissions guide explains these choices; each endpoint lists its exact scopes.

For lookup tables, All tables includes tables added later. Selected tables is limited to the selected resources. Field permissions can narrow the values returned. Choose access deliberately when a connection can change tables or their fields.

Connect an AI app

MCP supports a personal sign-in connection for approved alpha clients and a key-based connection for Claude Code. Follow Connect an AI app for both paths.

For a key-based MCP connection, select Create a key for Claude in Integrations. It starts with no access: choose permissions, tables, objects, and workflows. Use Custom when you need to choose individual permissions, including merging or rebuilding records. Review the choices before creating the key.

For a sign-in connection, an organization admin reviews the client, organization, permissions, and resources in Neon Deer. Manage the resulting connection under Connected AI apps in Integrations. Do not copy its access token into your application as a REST API key.

Rotate a key

Open the key's page and rotate it when it needs replacing. The old key stops working immediately. There is no overlap period. Copy the replacement when shown, update every caller using the old key, and verify a request from the application. Coordinate the change if several services use that key.

If you lose the secret, replace or rotate the key. Its detail page cannot reveal the original secret again. An MCP key keeps its connection purpose when rotated.

Revoke access

Revoke a key from its page to stop new authenticated requests. For a personal AI connection, use Disconnect under Connected AI apps. Reconnect and approve a new connection if different access is needed.

Revoking access does not undo completed writes or erase information already returned to a caller. Check the status of accepted work rather than assuming that closing a client canceled it. See operation status.