Developers
API keys
Create scoped Stepwik API keys, understand plan and rate limits, and use keys with MCP and the API playground.
API keys authenticate MCP clients, automations, curl/SDK calls, and the Studio API Playground. Treat the secret like a password. It can act within the key’s scopes on that workspace.
Create a key
Open API Keys
Open Studio → Developer → API Keys (under Build with Stepwik).
Choose the workspace
Create the key in the workspace you want to automate (personal or organization).
Name and scopes
Name the key and enable scopes (start narrow).
Copy the secret
Copy the secret immediately: you may not see it again.
Store safely
Store it in a password manager or secret store (never in a public repo).
Keys look like:
stepwik_<id>_<secret>Send them as:
stepwik-api-key: stepwik_<id>_<secret>Scopes
| Scope | What it allows | Available on |
|---|---|---|
labs:read |
List and read labs | Personal + org |
labs:write |
Create and update private lab drafts | Personal + org |
courses:read |
List and read courses | Personal + org |
courses:write |
Create and update course drafts | Personal + org |
account:read |
whoami helpers and organization membership (/organizations) |
Personal + org |
billing:read |
Subscription / billing summary | Personal + org |
logs:read |
API usage analytics and request logs | Organization keys only |
Default when creating a key in Studio: labs:read and courses:read.
Match scopes to the playground endpoints you need. Write scopes never publish; they only create/update private drafts.
Limits
Daily plan quota
Counted across Enterprise API HTTP calls and MCP usage for that subscription:
| Plan | Requests per UTC day |
|---|---|
| Freemium | 50 |
| Pro / Organization (API access enabled) | Unlimited |
Studio surfaces remaining daily requests in the playground when a numeric limit applies. Exhausted quota returns PLAN_API_DAILY_LIMIT_EXCEEDED.
Burst rate limits (per key, 15 minutes)
| Traffic | Limit |
|---|---|
whoami |
300 / 15 min |
Account (organizations, billing) |
120 / 15 min |
| Labs read / format | 100 / 15 min |
| Courses read / format | 100 / 15 min |
Lab / course update (PUT) |
60 / 15 min |
Lab / course create (POST) |
30 / 15 min |
Full endpoint list: API Playground.
Use with MCP
https://mcp.stepwik.com/mcpstepwik-api-key: stepwik_<id>_<secret>See MCP for client configs. Use a separate key per client or environment (laptop vs CI).
Usage and logs
On API Keys in Studio:
| Tab | Purpose |
|---|---|
| Keys | Create, copy id, see scopes, revoke |
| Playground | Try every available Enterprise API route |
| Usage | Request counts, latency, top actions (analytics) |
| Logs | Request-level history (org; needs logs:read where gated) |
Rotate and revoke
Create a replacement key
Create a new key with the same scopes.
Update clients
Update every client that used the old secret.
Smoke-test
Smoke-test with
GET /v1/eapi/whoamior MCPwhoami.Revoke the old key
Revoke the old key in Studio.