# Authentication

Source: https://neondeerdata.com/docs/api/authentication/

Create and manage API keys, or authorize an AI connection.

## Create an API key

An organization admin creates keys in **Settings → Integrations**. Only APIs your organization can access are offered. Alpha access is granted to an organization separately from its plan.

1. Select **Create API key**, enter a name that identifies the application, and choose an expiry.
2. New keys start with no app access. Choose **Off**, **Read**, **Read & write**, or **Custom** for each offered app. Review the individual permissions before allowing changes.
3. Choose the lookup tables, Duplicate Detection objects, and Attio workflows it can use, as applicable.
4. Check the permissions and resource selection on the create page, then select **Create API key**.
5. Copy the key when it is shown. It is shown once. Save it in your server's environment or secrets manager.

The create flow includes a sample request. Use the key's Playground to inspect responses. Never paste the key into a conversation or commit it to source control.

## Send a REST request

```bash
curl 'https://api.neondeerdata.com/v1/self' \
  -H "Authorization: Bearer $NEON_DEER_API_KEY"

```

`GET /v1/self` identifies the key and organization and describes its access. Check the organization before writing. The [Who am I reference](https://neondeerdata.com/docs/api/meta/self/) lists the response fields.

Keys authenticate an integration with one organization. They are separate from your personal Attio sign-in. A key does not gain access to every resource just because the organization has installed an app.

## Choose access

Row reads and writes, table settings, scans, AI assessments, merges, scheduling, and organization settings have separate permissions. Operations can require more than one permission. The [permissions guide](https://neondeerdata.com/docs/api/permissions/) explains these choices; each endpoint lists its exact scopes.

For lookup tables, **All tables** includes tables added later. **Selected tables** is limited to the selected resources. Field permissions can narrow the values returned. Choose access deliberately when a connection can change tables or their fields.

## Connect an AI app

MCP supports a personal sign-in connection for approved alpha clients and a key-based connection for Claude Code. Follow [Connect an AI app](https://neondeerdata.com/docs/api/mcp/) for both paths.

For a key-based MCP connection, select **Create a key for Claude** in Integrations. It starts with no access: choose permissions, tables, objects, and workflows. Use Custom when you need to choose individual permissions, including merging or rebuilding records. Review the choices before creating the key.

For a sign-in connection, an organization admin reviews the client, organization, permissions, and resources in Neon Deer. Manage the resulting connection under **Connected AI apps** in Integrations. Do not copy its access token into your application as a REST API key.

## Rotate a key

Open the key's page and rotate it when it needs replacing. **The old key stops working immediately. There is no overlap period.** Copy the replacement when shown, update every caller using the old key, and verify a request from the application. Coordinate the change if several services use that key.

If you lose the secret, replace or rotate the key. Its detail page cannot reveal the original secret again. An MCP key keeps its connection purpose when rotated.

## Revoke access

Revoke a key from its page to stop new authenticated requests. For a personal AI connection, use **Disconnect** under **Connected AI apps**. Reconnect and approve a new connection if different access is needed.

Revoking access does not undo completed writes or erase information already returned to a caller. Check the status of accepted work rather than assuming that closing a client canceled it. See [operation status](https://neondeerdata.com/docs/api/operations/).