Skip to main content
Personal API keys are the first-party credential for programmatic access to Casa Layer. The REST API and the MCP server accept the same keys. Keys are managed in the app, never over the API itself. A third-party system must use a partner API credential, not a casa_ key. Partner credentials are org-scoped machine credentials. They do not authenticate the MCP server.
Connecting Claude? Use Casa Layer sign-in instead — add the MCP URL as a custom connector and sign in, no key required (see MCP server). Personal API keys are for Cursor, the MCP Inspector, scripts, and REST access.

​
Creating a key

  1. In the Casa Layer app, open the account menu at the bottom of the left sidebar and choose Account settings.
  2. Click Create Key, name it after what will use it (e.g. Reporting pipeline), and choose its scope:
    • Whole group (default) — reads every property in your organization. Send X-Property-Id to narrow one request.
    • Pinned to one property — permanently narrowed to that property. The key ignores X-Property-Id.
  3. Copy the casa_… token from the confirmation dialog.
The token is shown once. Casa Layer stores only a SHA-256 hash — if you lose the token, revoke the key and create a new one.

​
What a key can do

Keys are read-only and carry every public read scope except read:integrations. They can list the integration roster (GET /v1/integrations). Connection metadata stays session-only. A key can never create or revoke other keys, so a leaked key’s blast radius stays read-only. See the scope table for the full list. Any member of your organization can manage the group’s keys; keys only grant the read surface members already hold.

​
Revoking a key

Revoke from the same Account settings page. Revocation is immediate — the next request with that key fails with 401 — and permanent. Revoked keys stay listed (greyed out) for audit.

​
Good practice

  • One key per consumer. Name keys after the system using them so revocation is surgical.
  • Pin where you can. If a consumer only needs one property’s data, pin the key at creation rather than relying on the drill-down header.
  • Rotate by overlap. Create the replacement key, deploy it, then revoke the old one.
  • Keep keys out of source control. Inject them via environment variables or your secret manager.