# Keys and allow lists

## Keys

Agents connect with an MCP key, which starts with `l10m_`. Owners and admins create them on the project's MCP page. A key is shown once, stored only as a hash, and opens its own project's server and no other. Revoke it on the same page and it stops working at once.

How many keys a server may have depends on your plan: see [Plans and limits](../get-started/plans-and-limits#mcp). After a downgrade, keys over the new number are kept but suspended, newest first, until the plan comes back or you revoke older ones.

## Which tools are on

When the server is made, its reads (`GET` and `HEAD`) are on and every write is off. Owners and admins turn each tool on or off. At most 60 tools can be on at once: an agent chooses worse from a long list.

## Allow lists

On Pro and up, a key can carry an allow list: it sees only the tools on that list that are also on for the server. A key without one sees every tool that's on. On Free, every key sees every tool that's on.

| Answer | When |
| --- | --- |
| “Tool allow lists come with Pro.” | An allow list on Free. |
| “Choose at most 60 of this server’s tools.” | An allow list too long, or with a tool name that isn't one. |
| “This server has its … keys. Revoke one first.” | The server has as many keys as the plan allows. |

## Where this comes from

- `app/hosted-mcp/_lib/keys.ts`
- `app/hosted-mcp/_lib/server.ts`
- `app/workspace/actions.ts`
- `app/workspace/_lib/quotas.ts`