Rotate a token

When you finish this page, the old rmr_ secret no longer works and every agent uses a new secret. There is one active token per workspace. Revoke is immediate.

When to do this

Do this if the secret was pasted into a ticket, a chat, a screenshot, or a git commit. Treat that string as public. Do not keep using it.

1. Open the key page

1. Sign in at rumora.ai.
2. Open the team workspace that minted the leaked key. Personal accounts have no API keys page.
3. Click API keys in the sidebar.

You should see the current key prefix, which looks like rmr_ plus a few characters. That prefix is not enough to authenticate. The full secret is only shown at create time.

2. Revoke the leaked key

Click Revoke key. Confirm if the page asks you to.

From this moment, any client that still sends the old secret gets HTTP 401 with "code": "UNAUTHORIZED". That is the expected result. It means the leak can no longer spend credits.

3. Create a new key

1. Click Create key.
2. Copy the full secret immediately. It starts with rmr_ and is long. A reload hides it and leaves only the prefix.

Store it in your password manager or in the agent's secret store. Do not commit it.

4. Put the new secret in every client

Do every place that had the old secret:

• Cursor: open MCP settings, replace rmr_YOUR_TOKEN in the Rumora server Authorization header, then reload MCP.
• Claude Code: run the add command again with the new secret. Restart the session.
• Scripts and curl: export a new TOKEN, or edit the Authorization header.
• Playground: paste the new secret into the Authorization field. It is stored in this browser tab only.

The JSON to paste into Cursor is in Sideload the MCP server.

5. Confirm the new key works

export HOST=https://rumora.ai
export TOKEN='rmr_YOUR_NEW_TOKEN'

curl -sS "$HOST/api/v1/usage" \
  -H "Authorization: Bearer $TOKEN"

You should see credits_left. If you still see "code": "UNAUTHORIZED", you pasted the prefix instead of the full secret, or the client is still sending the old header. Create the key again and replace the secret in the client.

If something fails

Only members who can manage settings can create or revoke a key. Everyone else can see the prefix. If you cannot click Create key, ask a workspace owner.