API keys

A Versalist API key authenticates supported requests outside the browser. Each key belongs to one user and has explicit scopes.

Platform keys and provider credentials

Scopes

read:challenges

Permits challenge listing, detail, Markdown export, reference item, and leaderboard requests.

submit:solutions

Permits challenge submission creation.

read:submissions

Permits access to the key owner's submission records.

Create a key

1. Open API keys.
2. Enter a name that identifies the environment.
3. Select only the required scopes.
4. Create the key.
5. Copy the plaintext value immediately.

The page shows the plaintext value one time.

Store a key

• Store local keys in an environment variable or approved secret manager.
• Store continuous integration keys in the platform secret store.
• Do not put a key in source code.
• Do not commit a key to source control.
• Do not expose a key in client-side code.

Use a key with the CLI

export VERSALIST_API_KEY=vk_live_...
versalist list
versalist start agentic-code-optimization-review

Read the CLI guide for command requirements and output files.

Use a key with MCP

Model Context Protocol (MCP) mode reads the same environment variable. Add it to the MCP server configuration.

{
  "mcpServers": {
    "versalist": {
      "command": "npx",
      "args": ["-y", "@versalist/cli", "mcp"],
      "env": { "VERSALIST_API_KEY": "vk_live_..." }
    }
  }
}

Rotate a key

1. Create a replacement key with the same required scopes.
2. Update the target environment.
3. Test the replacement key.
4. Revoke the old key.

Revoke a key

Revoke a key immediately when it is exposed, unused, or assigned to a retired environment.

1. Open API keys.
2. Find the key by name and last-use time.
3. Revoke the key.
4. Confirm that dependent requests now fail.