Account & Billing
API Keys & Tokens
The project API key, Account API tokens, and how agents and Chrome sign in.
SnagRelay has a few different credentials. They do different jobs.
| Project API key | Agent sign-in (OAuth) | Account API token | Chrome sign-in | |
|---|---|---|---|---|
| Scope | One project | One project's MCP | Your account | Owner account or an invite |
| Used by | Script, WordPress, SDK | Cursor, Claude Code, Codex | Jira, Azure DevOps, CI, scripts | Browser extension |
| How you get it | Install tab | Agent tab → Allow | Account → API tokens | Sign in as owner or Authenticate |
| Sensitivity | Public-safe | Revocable, 90 days | Secret | Login plus a one-time code |
Project API key
- One per project, created with the project
- Used by the script tag, WordPress, and the React Native SDK to load config and submit reports
- Found on the project's Install tab
- Safe to embed client-side. It only allows submitting reports to that project
Agents (OAuth)
Cursor, Claude Code, and Codex sign in with OAuth 2.1 and PKCE from the project's Agent tab. You click Allow once in the browser, and there's no token to copy.
Sign-in lasts 90 days. See your agent connections, and disconnect any of them, on the Agent tab.
Account API tokens
Under Account → API tokens, create a token for something that can't do OAuth: Jira,
Azure DevOps, CI, and scripts. You can also use one as a Bearer header with an MCP
client that doesn't support OAuth.
- Enter a name (for example
Jira) and click Create. - Copy your token now. It isn't shown again.
- The list shows each token's name, prefix, when it was created, when it expires, and when it was last used. Click Revoke to cut off anything using it.
Chrome extension
The Chrome extension doesn't use the project key.
- Owners click Sign in as owner. Every project you own loads automatically.
- Invited people click Authenticate, enter their email, then the 6-digit code we send. See Your access.