Users, roles and plans
How do I rotate or revoke a key?
You renew the write key and the server key in “Setup”, the server key on the “Server Events API” tab, where you can also revoke it. Read keys are revoked under “Exports & AI connections”, in the “API access” section, where you also create a new one. A new key is shown in full only once, and the old one stops working immediately.
What do I do if a key was published by accident?
- 01Write key: open “Setup” and choose “Create a new write key” at the snippet.
- 02Server key: open “Setup”, tab “Server Events API”, and choose “Create a new server key” or “Revoke”.
- 03Read key: open “Exports & AI connections”, section “API access”, revoke the old one and create a new one.
- 04Copy the new value immediately, enter it in every system that uses it and check that data arrives again. The old key is already invalid.
Caution
The new key is shown in full only once; afterwards only a prefix remains visible, because keys are stored hashed. Plan the rotation so the switch happens without a gap.
Last reviewed on 12 Oct 2026
In the customer portal
Also asked
- Withdraw a key
- Rotate a key
- Server key compromised
Related articles
- Where do I find the site ID, write key and server key?
Which key goes where, and which one may be public?
Site ID and write key are in the portal under “Setup” and belong in the browser tracking code. You create the server key in “Setup” on the “Server Events API” tab with “Create server key”; it is secret, belongs only in your backend and is shown in full only when it is created. Read keys for Claude and your own analyses are under “Exports & AI connections”, in the “API access” section.
- How do I connect my own AI tool?
Is there an MCP server for Metrunio?
Through Metrunio’s MCP server. It exposes the same read tools as the portal chat. Claude and ChatGPT sign in via OAuth: you choose in the portal which account they may read. Other tools use an API key of scope “read”, the same one a script would use for /v1/data.
- What security properties does Metrunio have?
How is separation between customers enforced?
Tenant separation is enforced in the database as well (row-level security), not only in application code. Tracking elements are signed, there is no open redirect, and signed requests are protected against replay.