Integrations

API key access

Understand what a Verdly API key is and what each access type grants, so you can give a connected tool only the access it needs.

Last updated

A Verdly API key lets a tool you trust — such as an AI assistant connected through the MCP server, or your own script using the REST API — act with your account. This page explains what a key is and what each access type grants, so you can give a tool only what it needs.

What a Verdly API key is

A Verdly API key is a secret string, always beginning with vk_, that a tool sends with each request to identify itself as you. Anyone holding a key can use the access it was granted, so a key is as sensitive as your password.

You create keys under Settings → API keys in the Verdly app; the MCP integration guide walks through generating one and connecting a client step by step. The full key is shown only once, at creation, so you copy it then and store it somewhere safe.

Access is granted per key

Access is chosen for each key, not for your account as a whole. When you create a key you tick the access types it should have, and the key can only ever do those things — this is the principle of least privilege: grant the smallest access that does the job.

A new key does not get full access by default. Only Financial data is pre-selected, and nothing more is granted unless you tick it. You can give a single key one access type or both, and you can create separate keys with different access for different tools.

Access types

Verdly offers two access types. What each one lets a connected tool do is described below in plain terms; the exact capabilities may grow over time, but the guarantees for each type stay the same.

Financial data

Grants read-only access to the figures in your account. A tool with this access can look at your data but cannot add to, change or delete anything.

It can read:

  • your net worth — the current figure, its full history, and your performance against inflation;
  • your holdings — your assets and debts, each in the currency it is recorded in;
  • your categories — how you have organised your holdings;
  • the values you have recorded each month, and your monthly notes;
  • your milestones and your progress towards each one;
  • the currency rates used to convert your figures;
  • your latest AI Insights summary.

This read-only guarantee holds however the tool connects — it is the same whether the tool uses the MCP server or Verdly’s REST API. A Financial data key can never write to your account through either route.

Ask Verdly

Grants a connected tool the ability to use Ask Verdly on your behalf.

Unlike Financial data, this access is not read-only. Asking a question holds a conversation on your account — the exchange is saved to your Ask Verdly history — and each question spends one of your monthly Ask credits, drawn from the same allowance as asking in the app. Grant this access only to a tool you want to be able to ask questions as you.

Choosing the least access you need

Give each key only the access its tool actually uses:

  • A tool that just reads your finances — the MCP server for most assistants, a reporting script, a dashboard — needs Financial data only. Leave Ask Verdly off.
  • Grant Ask Verdly only when you specifically want the tool to ask questions for you, and remember it will spend your Ask credits.
  • Use a separate key per tool or device, so you can revoke one without disrupting the others, and so each key carries only the access that tool needs.

Key expiry

Every key has an expiry. You choose it when you create the key — 30, 90 or 365 days — and the key stops working automatically once it passes. We recommend the shortest period that suits you, and creating a fresh key when one is about to expire rather than reaching for a long-lived key.

Revoking a key

You can stop a key working at any time. Open Settings → API keys, find the key, and select Revoke.

Next steps