Create and manage drawDB API keys

Create, rename, rotate, expire, and revoke drawDB Pro API keys for MCP clients and other integrations.

API keys let scripts and integrations act as your drawDB account. The current read-only API is used by the drawDB MCP server.

Treat keys like passwords

A key can discover cloud-diagram metadata across your team memberships and can read schemas that pass a fresh access check. Never commit a key to source control, paste it into chat, or share it with another person.

Create a key

Open the drawDB editor and sign in.
Select your avatar, then Manage account.
Open API keys.
Select Create key.
Give it a recognizable name, such as MCP on work laptop.
Choose an expiration: 30, 60, or 90 days; one year; or no expiration.
Create the key and copy the complete token immediately.

New keys default to a 30-day expiration. Names can contain up to 80 characters.

The token is shown once

drawDB stores a hash rather than the complete token. If you close the creation dialog without saving it, create a replacement key; the original value cannot be recovered.

Keys begin with ddb_. The API keys table later shows only a short prefix, expiration date, and last-used date so you can identify the key without exposing it.

Rename a key

Use the action menu next to a key and select Edit. Renaming changes only the label—it does not rotate the token or change its expiration.

Rotate a key

Use this sequence to replace a key without interrupting an integration:

Create a replacement key.
Update every client that uses the old key.
Confirm the replacement can connect.
Delete the old key.

Revoke a key

Open the key's action menu and select Delete.
Type DELETE in the confirmation dialog.
Select Delete key.

Deletion takes effect immediately. Every client still configured with that key will stop authenticating.

Understand key access

API keys are attached to your user account—not to the active workspace in the editor.

list_diagrams can expose IDs, names, dialects, and update times across every team you belong to. In the current release, that list can include a diagram whose schema read is later denied by Invite-only or No-access rules.
Changing the active workspace does not scope the key to that workspace.
Every schema request performs a fresh permission check; removing access blocks the schema even when its summary still appears in the list.
Local-only OSS diagrams are not available through the API.
Creating or renaming keys requires an active plan with cloud storage.
You can still delete a key after a plan or trial ends.

For least-privilege access, use a dedicated drawDB account with membership only in the workspaces the integration needs.

Choose an expiration

Prefer the shortest practical lifetime. Non-expiring keys reduce maintenance but increase the impact of an unnoticed leak. The Last used value can help you identify abandoned keys before revoking them.

Continue with Connect drawDB to AI tools with MCP.