Skip to content

API keys and personal access tokens

You will learn stream ingest keys versus personal access tokens for REST and MCP.

Cordo uses two different secret types. Mixing them up is the most common auth mistake: ingest keys cannot query, and personal tokens cannot ship production logs.

Quick comparison

Stream API key Personal access token
Format lax_<prefix>_<secret> lxp_<prefix>_<secret>
Purpose Ingest only REST API + MCP (manage, query, views, agent tools)
Where in the app Streams → API keys (selected stream) Settings → API tokens
Create control New API key New token
Shown once Yes Yes

Stream API keys

Use these to send events into one stream.

  • Native HTTP JSON: header X-API-Key: lax_…
  • OpenSearch-compatible _bulk: HTTP Basic — username ignored, password is the API key
  • OTLP Logs: X-API-Key or Authorization: Bearer lax_…

Session JWTs from the web app cannot ingest. Revoking a key stops ingest with that secret immediately.

Hands-on: Manage stream API keys.

Personal access tokens

Use these for scripts, Cursor, and other MCP clients.

  • Header: Authorization: Bearer lxp_…
  • Permissions: least-privilege scopes (or full access), optionally limited to selected streams you can already access
  • Cannot call HTTP ingest endpoints (/ingest, OpenSearch bulk, OTLP) — use a stream API key for production shippers; MCP ingest_events needs the events:ingest scope
  • Cannot create, rotate, or broaden another PAT (interactive login required)

Existing tokens created before scopes shipped keep full access (*) so agents keep working until you rotate them to narrower scopes.

Hands-on: Manage personal access tokens and Connect MCP.

Next