API Keys & Tokens

Project API key for embeds, Sign in / grants for Chrome and the editor, MCP tokens for CI.

SnagRelay uses a few different credentials for different jobs. Mixing them up is a common source of confusion.

Project API key

One per Project, created with the Project
Used by Web, WordPress, and the React Native SDK to load config and submit reports
Found on the Project’s Installation tab
Safe to embed client-side — it only allows submitting reports to that Project

The Chrome Extension does not use the project API key.

Owners — open the extension and click Sign in as owner. Every Project they own loads automatically.
Invited teammates — open the access email, then Authenticate Chrome on Your access.

Revoke on the project Team row invalidates that person’s extension grants. It does not rotate anyone else’s sign-in.

Owners — VS Code / Cursor Sign in as owner. Copy .cursor/mcp.json / .vscode/mcp.json from the project MCP tab (no token in that file).
Invited teammates — Authenticate VS Code / Cursor from Your access when the owner plan includes MCP.
CI / headless — personal MCP tokens on Account → API tokens. Unrelated to Chrome sign-in.

	Project API key	Chrome / editor (people)	MCP token (CI)
Scope	One Project	Owner account or Team grant	Owner PAT
Used by	Web / WordPress / SDK	Browser extension, VS Code / Cursor	Headless agents
How you get it	Installation tab	Sign in as owner or access-email Authenticate	Account → API tokens
Sensitivity	Public-safe	Login / invite grant	Keep private