An API key lets something other than your browser act as you: a nightly script that exports scores, a CI job that checks visibility before a release, the Looker Studio connector, or a local MCP install running in an environment where a browser sign-in is not possible. Keys begin cituna_sk_ and are shown exactly once, because they are stored hashed rather than encrypted: Cituna can check a key but cannot reproduce it. Before you generate one, check whether you need it: if you are connecting Claude to Cituna interactively, the hosted MCP connector uses a browser sign-in and needs no key at all, which is one fewer secret to rotate.
1. Check whether you need a key
For Claude on the web, mobile, Desktop or Code, add the hosted connector at https://mcp.cituna.com/mcp instead. It authorises through your browser and creates no long-lived secret.
Generate a key when there is no browser in the loop: scripts, scheduled jobs, CI, or the Looker Studio connector.
2. Generate the key
Open Integrations → Claude / MCP access and generate a key. Name it after where it will live, such as "ci", "looker" or "laptop", so revoking the right one later is obvious.
Copy it immediately. It is displayed once and cannot be shown again; if you lose it, revoke it and generate another.
3. Store it as a secret, never in the repo
Put it in an environment variable or your CI secret store. A key committed to a repository is a key that has to be rotated, even in a private repo.
Keys act with your workspace permissions, so treat one like a password rather than like a public identifier.
Environment variable
CITUNA_API_KEY=cituna_sk_your_key_here4. Use it
For a local MCP install, pass it as CITUNA_API_KEY in the server config. For the Looker Studio connector, paste it on the connector's key screen.
MCP calls are metered separately from the underlying scan and Search Console meters, so you can see automated volume distinctly from what you do in the app.
5. Rotate and revoke deliberately
Revoke a key the moment the thing it was made for is retired, and whenever someone with access to it leaves. Revocation is immediate.
Because each key is named per destination, rotating one never takes down the others.
Troubleshooting
My key is rejected as invalid or expired.
Check three things before assuming the key is wrong. A stale local install of the MCP package can send an old auth header, so re-run with npx -y. A proxy or redirect between http and https will strip the Authorization header. And a key that was revoked stays revoked; generate a new one rather than re-pasting.
What can a key do that I cannot undo?
Write actions are limited to your own workspace: queueing an article, marking one published, changing a gap status, starting a scan. Write access needs Pro or Max; on Starter a key is read-only. Nothing a key can do reaches your website. Publishing runs through the destination connectors and their own credentials.
Can I scope a key to one brand?
Not today. Keys carry your workspace permissions. If you need narrower access for an agency client, a separate workspace is the supported boundary.
I lost the key. Can support retrieve it?
No, and that is deliberate. Keys are stored hashed, so nobody, including us, can read one back. Revoke the lost key and generate a replacement.