API keys and tokens
API keys and tokens
Replay has two separate credentials. Learn which one each tool needs and how to create, store, and revoke them.
Replay has two separate credentials. They are issued by different apps and are not interchangeable.
| Credential | Created at | Used by |
|---|---|---|
| app.replay.io API key | app.replay.io team settings | The replayio CLI, the @replayio/playwright plugin, replayio upload-source-maps, CI upload workflows, and the Authorization header when connecting to Replay MCP |
| Replay QA API token | qa.replay.io Settings > API | The Replay QA REST API and Replay QA MCP server. Always starts with lqa_ |
If a request is rejected with an authentication error, the first thing to check is that the credential came from the right app.
app.replay.io API key
This key authenticates anything that uploads recordings or source maps, and lets Replay MCP read recordings that belong to a team.
Create a key
- Open app.replay.io, open your team's settings, and go to API Keys.
- Give the key a name and the permissions it needs, then click Add.
- Copy the key. It is shown once.
Keep your API key safe
Copy and save the key immediately; it is not visible again after you close the settings. Do not commit it to your repository.
Revoke a key
The team settings list every active key. Delete any key you no longer need.
Use the key
The Replay tools all read REPLAY_API_KEY from the environment, and each also accepts the key as an argument or option.
Terminal
For local development you can keep the key in a .env file loaded with dotenv. Make sure the file is in .gitignore.
.env
In CI, store the key as a repository secret. Most providers (for example GitHub Actions and CircleCI) expose secrets to workflows as environment variables.
For Replay MCP, pass the key as the Authorization header value in your MCP client configuration. See Replay MCP for per-client examples.
Replay QA API token
This token authenticates the Replay QA REST API at https://qa.replay.io/api/v1 and the Replay QA MCP server at https://qa.replay.io/api/mcp. It does not work with the replayio CLI or with Replay MCP.
Create a token
- Sign in at qa.replay.io and open Settings.
- In the API section, generate a token. Give each script or agent its own named token so you can revoke them independently.
- Copy the token. It starts with
lqa_and is shown once.
Use the token
Send it as a bearer token on every request:
Authorization: Bearer lqa_your_token_here
The token acts as the user who created it and covers every project that user can access. Tokens are listed and revoked from the same API section in Settings.
For MCP clients that support OAuth sign-in, you can connect to the Replay QA MCP server without a token at all; see Driving Replay QA from a coding agent.