Skip to main content
API keys are the credential for programmatic access to Casa — the REST API and the MCP server accept the same keys. Keys are managed in the app, never over the API itself.
Connecting Claude? Use the OAuth flow instead — add the MCP URL as a custom connector and sign in, no key required (see MCP server). API keys are for Cursor, the MCP Inspector, scripts, and REST access.

​
Creating a key

  1. In the Casa app, open the account menu at the bottom of the left sidebar and choose Account settings.
  2. Click Create Key, name it after what will use it (e.g. Reporting pipeline), and choose its scope:
    • Whole group (default) — reads every property in your organization.
    • Pinned to one property — permanently narrowed to that property; the X-Property-Id drill-down header is ignored.
  3. Copy the casa_… token from the confirmation dialog.
The token is shown once. Casa stores only a SHA-256 hash — if you lose the token, revoke the key and create a new one.

​
What a key can do

Keys are read-only and carry every read scope except read:integrations — integration and connection metadata is reserved for signed-in sessions. A key can never create or revoke other keys, so a leaked key’s blast radius stays read-only. See the scope table for the full list. Any member of your organization can manage the group’s keys; keys only grant the read surface members already hold.

​
Revoking a key

Revoke from the same Account settings page. Revocation is immediate — the next request with that key fails with 401 — and permanent. Revoked keys stay listed (greyed out) for audit.

​
Good practice

  • One key per consumer. Name keys after the system using them so revocation is surgical.
  • Pin where you can. If a consumer only needs one property’s data, pin the key at creation rather than relying on the drill-down header.
  • Rotate by overlap. Create the replacement key, deploy it, then revoke the old one.
  • Keep keys out of source control. Inject them via environment variables or your secret manager.