API keys
An API key lets the CLI, a coding agent or your own code call Chartnaut as you. You create and revoke keys on the Developers page, in the menu under your name.
A key acts as you. It can read, save and run anything your account can, within the scopes you give it, and it uses your plan's limits exactly as the app does. Treat it like a password.
On Free
API access is included on Starter and above. The Developers page still opens on Free, with the install commands and the key list, but it cannot give you a working key:
Create API key opens the form, and submitting it shows API access is included on Starter and above.
Approving
chartnaut loginin the browser shows the same message after you click Connect.A key made before a move to Free stays in the list, and every call it makes gets
403 plan_limit. It works again within a minute of upgrading.
Revoking works on every plan, so you can always clear out old keys. Plans and limits lists what each plan includes.
Create a key
Open the menu under your name and choose Developers.
Under API keys, click Create API key.
Type a Name you will recognise later, such as Laptop CLI.
Untick any Scopes the key does not need. At least one must stay ticked.
Pick when it Expires: Never, 30 days, 90 days or 1 year. The default is 90 days.
Click Create API key.
Copy the key. Chartnaut shows it once, and closing the dialog loses it for good.
The next screen shows the key, and under it the line that signs the CLI in with it:
chartnaut login --token cn_live_XXXXA third line for Claude Code over MCP is marked Coming soon. For your own code, send the key as a bearer token; API overview shows how.
Claude CodeMost CLI users never open this dialog. Approving chartnaut login in the browser makes a key named CLI on followed by your computer's name, with every scope and no expiry. Sign in covers it.
Scopes
A scope narrows what a key can do. It never adds anything your account cannot already do.
Scope | Lets the key |
|---|---|
| Every read: your scripts, versions, a definition's events, runs and results, instruments, timeframes, the docs and your usage. Also validating a script without saving it |
| Create scripts, save new versions, change a name, description or visibility, and delete |
| Start and cancel runs, and run a definition over history |
A key for a dashboard that only reads results needs scripts:read alone. A key for a coding agent that writes and tests scripts needs all three. A call outside the key's scopes gets 403 forbidden_scope.
The keys list
Each key shows its name, its first characters (cn_live_ and four more), its scopes, when it was created, when it was last used and when it expires.
An expired key stays in the list marked Expired until you revoke it, and it stops working the moment it expires.
You can have 20 keys at once, not counting expired ones. Make one per machine or per tool, so revoking one never breaks the others.
Revoke a key
Click Revoke on the key.
Click Revoke again in the confirm dialog.
Anything using the key stops working straight away, and it cannot be undone.
chartnaut logout revokes the key the CLI is signed in with, including one you gave it with --token. Your own code can do the same with Revoke the current key. Revoke a key at once if it ends up in a commit, a log or a chat.