Generate an API Key

API keys live on Settings → API & MCP Access. To get there, click your name in the top right of the dashboard to open the account menu, then choose API & MCP Access under Developer. API & MCP Access is a main-account page, so switch to your main account first if a sub-account is active.

1. In the API Keys card, click Create API Key.
2. Give the key a Name that helps you recognize it later (for example "My CRM Integration").
3. Leave Allow MCP access on if an AI assistant (Claude, ChatGPT and others) will use this key through the thanks.io MCP server at mcp.thanks.io. Switch it off for a key that only calls the REST API. An MCP-enabled key lets an agent read your account and send physical mail on your behalf.
4. Click Create.

Your new key is shown in a Your New API Key dialog with a copy button. Keys begin with tio_.

Important: The key is only shown once. Copy it before you close the dialog. If you lose it, delete it and create a new one.

The API Keys list shows each key's name, an MCP badge for MCP-enabled keys, the start of the key, and when it was created. Deleting a key asks you to confirm, because anything using it stops working at once.

Send the key as a Bearer token on every request. See Authorization Headers.

MCP Permissions

The MCP Permissions card on the same page controls what an AI assistant connected through MCP can spend money on. An assistant can always plan, design, and preview mail without these; each switch is off until you turn it on:

• Allow orders via MCP - lets an assistant place real, paid mail orders and turn on recurring campaigns. Orders are charged to your account and can't be recalled once printing starts. The assistant still shows you a preview and asks before each send.
• Allow lead purchases via MCP - lets an assistant buy lead data, such as looking up a mailing address from an email address. Each address found costs 7¢.

If an assistant needs one of these, it asks you to come to this page and turn the switch on, so spending is always your explicit choice.

The same page also has API Settings (API Test Mode and Append "Or Current Resident"), Connected Applications (apps you have authorized, which you can revoke), and OAuth Applications for building your own OAuth app.