Manage API keys, MCP keys, and service accounts

Use API keys to connect applications to the REST API, and MCP keys to connect AI tools to DataDoe. Each key uses either a person’s access or a service account’s access.

Choose a key type

• Personal keys use their owner’s current roles and account, Action, and data table access.
• Service account keys use permissions and account, Action, and data table access set for that Service account, limited by its creator's current access.

To create personal keys, your role must allow Personal API keys or Personal MCP keys, as appropriate. These permissions allow the connection; your other permissions determine what it can do.

Organization Admins can manage every Service account and its keys. Other Users need Manage service accounts and can manage only the Service accounts they created. They can assign only permissions and resource access they already have, up to their current level.

Service accounts do not automatically receive their creator's permissions. They cannot sign in to the app or use personal Plugins, MCP OAuth, or DataDoe support ticket tools.

Create a service account

1. Open Settings → Permissions → Service accounts (opens in a new tab).
2. Select Create service account, enter a name, and confirm.
3. Choose the permissions the integration needs.
4. Set Sellers and Vendors access to All or Selected.
5. For Selected account access, choose each required Group or ungrouped account and select Add access.
6. Set Actions access and Data tables access independently to All or Selected.
7. For Selected access, under Assigned Actions and data tables, choose each required resource and select Add access.
8. Enable Access PII data only if the integration needs personal data and the Organization has PII access enabled.

Only permissions available to Service accounts appear in the table. For non-Admins, permission choices also stop at their own access level. New Service accounts start with no permissions or Sellers and Vendors access. Actions and data tables start at All only if their creator has All access. Select only the resources the integration needs.

Access PII data covers personal information in tables, Action requests and results, and generated Files. It starts disabled for new Service accounts and remains limited by the creator's current PII access. All accounts, Actions, or tables access does not grant PII access.

All includes current and future resources of the selected kind. Selected includes only explicit assignments. A Group assignment includes its current and future members. Permission and access changes save immediately.

Service accounts have their own permission settings; you do not assign user roles to them. See Manage roles and access for permission levels, resource access, and how existing PII grants are handled.

Create an API or MCP key

1. Open Integrations → REST API (opens in a new tab) or Integrations → MCP (opens in a new tab).
2. Select New key.
3. Choose Personal or Service account from Key type.
4. For a service account key, select an active service account.
5. Enter a key name, choose when it expires, and select Create key.
6. Copy the key before closing the dialog and store it securely.

The Key type dropdown explains whose access the key uses. When Service account is selected, Manage service accounts opens the settings to create or configure an account. DataDoe shows the full key value only once.

DataDoe sends email reminders before keys expire. Replace or update a key before its expiration date to keep the integration working.

Use the REST API connection guide or MCP connection guides to connect your application.

Manage keys and service accounts

The REST API and MCP tables show each key’s type, status, expiration date, and last use. For a service account key, select the service account name to open its settings. The page address keeps the selected service account. You can bookmark it or share the link with another Admin.

In Settings → Permissions → Service accounts, select Manage beside an account to:

• rename it or change its permissions and account, Action, and table access
• enable or disable the service account
• edit a key’s name or expiration date
• enable, disable, or delete an individual key
• delete the service account and revoke all its keys

Disabling a service account blocks all its keys. Deleting it revokes all its keys and stops integrations that use them. Changing its permissions or resource access affects every key attached to it. Reducing the creator's access also restricts the Service account. Removing the creator's Manage service accounts permission blocks all its keys and scheduled work.

Manage your personal keys from their REST API or MCP integration table. Personal keys stop working if their owner is disabled or loses the relevant Personal API keys or Personal MCP keys permission. Removing other permissions or account, Action, or table assignments restricts what those keys can do.

Connect with MCP OAuth

MCP OAuth lets a supported AI client connect through DataDoe sign-in without a copied key. Your role must allow MCP OAuth. The connection uses your current permissions and account, Action, and data table access, just like a personal key.

Service accounts use keys instead of OAuth. Choose only the permissions and accounts an integration needs. A Service account created by a User remains limited by that User's current access.