API keys
Mint keys, connect tools, and enable API writes for your community.
Settings → API/MCP is where you create API keys and connect external tools (including LLM agents) to JOGL Network. This page is the admin-facing companion to the developer Authentication reference.
Connect a tool
The Connect a tool panel gives you the MCP server endpoint —
the branded https://my.jogl.network/mcp URL, used in the one-click OAuth snippets and the
API-key snippets alike — ready to copy into Claude
Code, Claude Desktop, or another MCP client. The panel falls back to the raw Supabase functions
URL only on preview or local builds, where no branded host exists; that URL still works with an
API key anywhere.
Create a key
Create keys with a scope tier:
- Read —
search:read,profile:read,enrich:read. - Read + Write — adds
member:writeandenrich:write.
An Advanced expander exposes granular scopes, including the side-effecting self:enrich.
Keys are personal (minted by you, for you — organization-owned keys can no longer be
created) and the secret is shown once at creation. The key's rate-limit tier is fixed when
it is minted; see rate limits.
You can create keys in live or test environments, but read what "test" means here carefully.
A test key is not a sandbox. The choice changes the secret's prefix (jogl_test_ instead
of jogl_live_) and how the key is labelled — nothing else. A test key reads and writes your
real data, through the same endpoints, with the scopes you gave it. There is no separate
sandbox it routes to, and it isolates nothing. Treat a test key with write scopes exactly as
carefully as a live one.
Enabling write access
Read keys work immediately. Write keys additionally require you to turn on Write access for the owning account (your personal account, or each organization you own/administer):
- Enabling records a versioned write attestation and flips the account's write flag on.
- Enabling for a community's owner also lets that community's admins add members via the API.
A Connected apps section lists the OAuth (WorkOS) connectors that have been granted access — each connector's write capability is gated by the same attestation. When just-in-time write consent is switched on for your account, a write-consent queue also appears here, listing write requests waiting for your approval.
Enabling write access authorizes automated changes to your communities' data. Only enable it for keys and connectors you trust, and revoke anything you're unsure about — revocation takes effect on the next request. What stops a key is revocation, or the expiry it was given when it was minted — and keys created here are minted without one, so revocation is the only stop a key from this page has. For a connected app, revoking it here is the only stop at all. Deleting your account stops neither, as Privacy & GDPR explains.