Getting started
Issue an API key and make your first call from an MCP client
Issue an API key
Sign in to Goono and open API keys for the workspace you want to use. Any workspace member can issue their own key. Choose a name, a scope, and an optional expiry.
| Scope | Allows |
|---|---|
read | Browse, search, download files |
write | read + create, rename, delete folders, move notes |
The plaintext key is shown only once
Goono stores only a hash of the key. If you lose it, revoke it and issue a new one. Keep keys out of .env files, commits, and chat logs.
- Keys look like
gno_live_<key_id>_<secret>. Staging keys start withgno_test_. - Keys are scoped to one workspace and one user. For several workspaces, issue a key for each and register separate servers.
- Each user can hold up to 10 active keys per workspace. Revocation takes effect immediately.
Register the server in your client
Every request carries the key in the X-Goono-Key header. With Claude Code it is one line:
claude mcp add --transport http goono https://prd-mcp.goono.xyz/mcp \
--header "X-Goono-Key: gno_live_<key_id>_<secret>"For other clients see Connect a client.
Verify with a first call
Ask something like the following and the client will call get_me then list_projects:
Show me my Goono projects
The get_me response tells you which workspace the key belongs to (workspace) and its scopes (apiKey.scopes). A 401 means the key format or expiry is wrong; a 403 WORKSPACE_PLAN_INACTIVE means the workspace plan has lapsed. See Errors and permissions for the full list.
When a key stops working
| Situation | Result |
|---|---|
| You or a workspace admin revoke the key | 401 KEY_DEACTIVATED from the next request |
| The key owner leaves or is removed from the workspace | Key is revoked automatically, 401 |
| Expiry passes | 401 KEY_EXPIRED |
| Workspace plan lapses | 403 WORKSPACE_PLAN_INACTIVE. The key survives and works again once the plan is renewed |
| Call from outside the workspace IP allowlist | 403 FORBIDDEN_BY_IP_ACL |
Key issuance and revocation are recorded in the audit log.