Automation Keys
For: Platform operators authenticating automation scripts, CI/CD pipelines, and MCP clients to manage their org programmatically.
Gateways | Connect | Gateway Keys | Automation Keys
Automation Keys are not gateway proxy keys — they don't authenticate application traffic through the gateway. They authenticate programmatic management of your org: either calls to the Management REST API, or an MCP client (Claude Desktop, Claude Code, and similar) connecting to Axemere's MCP server. For keys that authenticate application traffic through the gateway proxy, see Gateway Keys.
Navigation: console.axemere.ai/automation
Requires a Managed Gateway subscription (Growth Pack or Dedicated). Without one, this page shows an upgrade banner instead of the key management UI.
Table of Contents
Management API Keys vs. MCP Keys
The page has two tabs, each managing a different kind of key:
| Tab | Key prefix | Authenticates | Docs |
|---|---|---|---|
| Management API | mgk_ | Automation scripts and CI/CD pipelines calling the Management REST API | Management API Reference |
| MCP Server | mcpk_ | Claude Desktop, Claude Code, and other MCP clients connecting to Axemere's MCP server | MCP Server Reference |
Both tabs share the same create/edit/revoke UI described below — only the key's prefix and intended client differ.
Key Format
mgk_<random-value> # Management API mcpk_<random-value> # MCP Server
Like Gateway Keys, the plaintext value is shown once at creation time in a reveal-once dialog, with a required "I have copied this key and stored it securely" acknowledgment before you can close it. It cannot be retrieved again — if lost, revoke the key and create a new one.
Creating a Key
Requires a write-capable role (Admin or Owner).
- Open Automation Keys in the sidebar and select the Management API or MCP Server tab.
- Click New Management API Key / New MCP Key.
- Enter a descriptive Name (e.g.
github-actions,claude-desktop). - Choose a Scope — see Scopes below.
- Optionally set an Expiration date; leave blank for no expiration.
- Click Create. Copy the plaintext key immediately — it will not be shown again.
Scopes
Each key is created with one of two scopes:
| Scope | Management API | MCP Server |
|---|---|---|
| Read | View credentials, workloads, and usage | Claude can view credentials, workloads, and usage |
| Read/Write (default) | Also create and modify resources | Claude can also create and modify resources on your behalf |
Choose Read for reporting/monitoring integrations that should never be able to change configuration; choose Read/Write for automation that needs to create or update resources (e.g. provisioning workloads in CI).
Editing a Key
Click the edit (pencil) icon on a key's row to change its Name or Description. Scope and expiration are set at creation and can't be changed afterward — revoke and recreate the key if either needs to change.
Revoking a Key
Click Revoke on a key's row and confirm. Revocation is immediate and cannot be undone. Revoked keys move into the collapsed Inactive keys section at the bottom of the table, alongside expired ones, so the active key list stays focused on what's actually in use.
Related: Gateway Keys | Connect | Management API Reference | MCP Server Reference