# Settings Reference

## Open Settings

1. Open **Settings** from the app sidebar.
2. Select the section for the setting you need.

![Current Settings sections](/docs/images/navigation/settings-navigation.webp)

| Section          | Use                                                    |
| ---------------- | ------------------------------------------------------ |
| Profile          | Name, email, and avatar.                               |
| General          | Theme, notifications, and preferences.                 |
| Workspace        | Workspace name, color, and icon.                       |
| Notifications    | Choose which notifications you receive.                |
| Translation      | Show or hide the in-browser translation control.       |
| Issue Labels     | Create and manage issue labels.                        |
| API Keys         | Create and revoke your programmatic keys.              |
| MCP Servers      | Review MCP access and server capabilities.             |
| AI Provider Keys | Configure provider keys used by supported AI features. |
| Agents           | Configure coding-agent settings.                       |

Workspace People & Access is in **Admin → People & Access**, and role definitions are in **Admin → Permissions**. The current Workspace settings form covers appearance; it is not the member-management screen.

## API Keys

1. Open **Settings → API Keys**.
2. Select **Create API Key**, enter a name, choose the **Area** (**All of iKanban** or **Security only**), and choose whether to make it read-only. A read-only key can read data through the API and MCP but cannot create or update anything.
3. Create the key, copy it from the reveal panel, and store it in a secret manager before closing the panel.
4. Delete a key from the same page to revoke it.

Treat a key like a password. It represents its owner on supported agent routes. It does not grant access to browser-session-only routes such as key management, admin, billing, invitations, membership/role changes, sharing, or destructive deletes.

Some agent-facing REST routes accept `vk_` keys. The API applies a deny-list, so this does not make every `/api` route available. REST and MCP both enforce the key's limits: **Read only** blocks every create and update, and **Security only** keeps the key in the Security area. The key list shows each limit as a badge.

A **Security only** key can read and file security findings, scans and fix tasks, and nothing else. Give one to a scanner or a CI job. See [Team Security](/docs/security/team-security) for the MCP tools and REST routes it can use.

On the same page, **MCP access** controls whether API keys can connect through MCP. The optional allowed-client list uses exact client names; an empty list allows any client. Changes can take up to five minutes to apply. Turning MCP off does not change REST access.

## MCP Servers

1. Open **Settings → MCP Servers**.
2. Review the server URL and capabilities shown by the app.
3. Register the MCP server in your client using Streamable HTTP and a bearer key.
4. Store the key in the client’s secret facility, not in shared project files.
5. Confirm the connection with a read operation and inspect the result.

See [MCP Usage](/docs/mcp/mcp-usage-from-field) for a client setup example. For allowed REST operations and session-only exclusions, see [Setup and Access](/docs/getting-started/setup).

## Workspace access and roles

Use **Admin → People & Access** to invite and review workspace members. Use **Admin → Permissions** for the workspace and team permission tables. See [Members and Roles](/docs/teams-projects/members-roles) before changing access.

The API/MCP role tokens and the labels offered by each UI are not interchangeable. The role guide lists each surface separately.