Home Apps and connections Use API keys and the Sanaf MCP server

Use API keys and the Sanaf MCP server

Last updated on Sep 23, 2026

An API key lets software you run talk to Sanaf: an AI assistant that speaks MCP, an automation tool, a script or a form on your website.

This is the opposite direction from connecting your apps. Here, other software asks Sanaf to do something.

Make a key

Only an owner or a manager can make or revoke a key.

  1. Open Settings > API keys.
  2. Under Make a key, fill in What it is for, for example "Zapier" or "my laptop". Each live key needs its own name.
  3. Under Which employee it may reach, leave Any employee in this workspace or pick Only Sanaf.
  4. Press Make the key.
  5. Copy the key right away. It is shown only once. If you lose it, revoke it and make another.

A key looks like emp_<workspace>_<secret>. The list shows each key's name, a short label, which employee it reaches and when it was last used. It never shows the key again.

Connect an MCP client

Add a server in your MCP client (Claude, Cursor or anything that speaks MCP) with:

  • URL: https://employees.sanafai.com/api/mcp
  • Header: Authorization: Bearer <your key>

Your client then gets four tools:

  • list_employees: the AI employees in the workspace, with their id and whether they are live.
  • ask_employee: give Sanaf a task or question. Takes employeeId, message and an optional chatId to continue a thread. Returns a chat id and a run id.
  • get_reply: read every message in that chat so far. Takes employeeId and chatId.
  • list_work: what Sanaf did recently, from its work log. Takes employeeId and an optional limit (20 by default, 50 at most).

Send a task over REST

For anything that does not speak MCP, send one POST:

curl -X POST https://employees.sanafai.com/api/v1/messages \
  -H "Authorization: Bearer <your key>" \
  -H "Content-Type: application/json" \
  -d '{"employeeId":"...","text":"Chase the overdue invoices"}'

Leave out employeeId if the key reaches only one employee. Add chatId to continue an earlier conversation.

The answer is 202 with employeeId, chatId, runId and status: "working". It does not wait for the reply, because Sanaf may take a while or wait for someone's approval. Read the reply with get_reply over MCP.

What a key can and cannot do

  • A key only reaches its own workspace, and a key made for one employee cannot reach another.
  • Sanaf's approval rules still apply. Anything that needs a person's yes waits for it.
  • A refused key gets a 401 that says why: no key sent, not a key, no matching key, or a revoked key.
  • A 503 means we could not check the key just then. Nothing was lost, so send the same request again.
  • The full developer reference is at https://employees.sanafai.com/docs/api.

Revoke a key

Press Revoke next to the key, then confirm with Yes, revoke and the key's name. It stops working right away and cannot be switched back on.

Related