Workspace members (canWrite) mint per-workspace-scoped API keys in settings. One-time reveal, list, revoke. Keys authenticate MCP + /api and scope them to the key's tenant (TenantContext). Docs page with install snippets per tool (Claude Desktop, Cursor, etc.).