Creating a key
A three-step wizard creates the key; it is shown only once, so you must copy and store it straight away.
Where to find: Left menu → Settings → AI Access → Create key Who it's for: The store owner In short: A three-step wizard creates the key; it is shown only once, so you must copy and store it straight away.
What is a key for?
A key is the ID card the AI app shows at the door. The app presents this card with every question; Treyza looks at the card and says "you may see this part of this store's data".
Three things are written on the card:
| On the card | What it means |
|---|---|
| Store | A key is bound to a single store |
| Mode | Read only, or read and write |
| Packs | Which subjects it may ask about (products, orders, reports…) |
Apps that connect through the consent screen (OAuth) — Claude Desktop and ChatGPT — do not need the steps on this page. There you do not create the key yourself; you approve access on the screen that opens in your browser. See Claude Desktop and claude.ai and ChatGPT.
Opening the tab
- Go to Settings in the left menu.
- Click the AI Access tab at the end of the settings tabs.
Depending on what you see:
| What is on screen | What it means |
|---|---|
| The key list and a Create key button | All set, carry on |
| "Only the store owner can use this screen." | You are not the owner; ask the owner for a key |
| "AI Access is not part of your plan" | You need to upgrade your plan |
| "You do not have an AI access key yet" | Right place — create your first key |
Step 1 · Name your key
Pressing Create key opens the wizard.
- In the Key name box, write a name that reminds you where you will use this key. Example:
Claude Code – laptop. The name can be at most 60 characters. - Pick a period from the Expires list: 30 days, 90 days, 365 days or Never. The default is 90 days.
- Press Continue.
The name is just for you; it does not affect the key itself. Creating a separate key per app and naming it after that app is the best habit: if one causes trouble you revoke only that one.
If your plan requires short-lived keys, only the allowed periods appear in the list and a line below reads "Your plan allows keys of up to … days."
Step 2 · Choose permissions
This step decides what the key can do; it is the most important one.
Access mode
You see two cards:
| Mode | What it does | When |
|---|---|---|
| Read only (Recommended) | The AI only reads data and cannot change anything | Almost always |
| Read and write | The AI can read and change data | Only when you truly need it |
The mode cannot be changed later. To change it you have to create a new key.
Tool packs
Packs decide which subjects the AI may ask about. Only the packs your own permissions cover are selectable; the reason is written under the ones that are not:
| Reason shown | What it means |
|---|---|
| "You do not have the permission this pack requires." | You lack that permission; a key cannot exceed you |
| "This pack is not included in your plan." | A plan limit |
| "This pack is not released yet; it is coming soon." | The pack is still being built |
| "This pack includes writing; choose Read and write mode to select it." | Write packs cannot be picked in read-only mode |
To see which tools are in which pack: Tool catalogue
Least-privilege rule: open only the subjects you will really ask about. If you will not ask about orders, do not open the orders pack. Narrowing later is allowed; widening is not.
IP allowlist (optional)
If you want the key to work only from certain internet addresses, list them here separated by commas (85.100.10.5, 85.100.10.6). Leave it empty and the key works from anywhere.
The box accepts individual addresses only; a range such as 85.100.10.0/24 cannot be written. If your home or office internet address is changed by your provider, leave this box empty — otherwise your key will silently stop working one day.
Make your choices and press Create key.
Step 3 · Your key is ready
This screen shows the key only once.
- Copy the key from the large box with the Copy button.
- Save it in a password manager or somewhere else safe.
- Tick the "I have copied the key and stored it safely." box below it.
- Press Done.
The same screen also shows a setup block under "Now connect it to your client", with your key already embedded in the command. You can copy it straight from there.
The window does not close until you tick the box: there is no X button, Esc does not close it and clicking outside does not close it. This is deliberate — once it closes, the key is never shown again.
If you lose the key it cannot be recovered; you revoke the old one and create a new one.
What a key looks like
A key looks like this:
trz_mcp_live_a1b2c3d4e5f6_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXlivemeans real store data,testmeans the trial environment. Test keys carry a Test badge in the list.- The list shows only the leading part (the mask); the whole key is never shown again.
The key list
Every key you create becomes a row in the table:
| Column | What it shows |
|---|---|
| Key | The name you gave and the mask |
| Mode | Read only / Read and write |
| Scope | Badges for the permissions granted |
| Last used | When it was last used |
| Today / 30d | Calls today and over the last 30 days |
| Expires | The end date, or "Never" |
| Status | Active / Revoked / Expired |
The three-dot menu at the end of the row offers:
| Action | What it does |
|---|---|
| View usage | The last 30 days' call chart and a list of recent calls |
| Rename | Changes only the name; the key stays the same |
| Edit scope | Takes back any of the packs granted |
| Revoke | Closes the key permanently |
Permissions only ever narrow
This rule is a deliberate security choice:
- The mode never changes.
- Packs and scope can only be taken back, never added.
- The expiry date can only be brought forward.
If you need more access you create a new key. If you try to widen one, the panel says:
"A key's permissions can only be narrowed, never widened. If you need more access, create a new key."
Revoking a key
- Press Revoke in the row's three-dot menu.
- Read the confirmation window: AI clients connected with this key lose access immediately.
- Press Yes, revoke.
Revoking cannot be undone. To keep a connection working you have to create a new key and reconfigure your app.
The usage card
View usage opens a card with:
- Total calls, Error rate and Last used boxes
- A Last 30 days bar chart (days with errors in a different colour)
- A Recent calls list: which tool, the result, how long it took and the IP address
If there are no calls yet it says "No calls yet" — that is not an error.
If you see a call you did not expect, revoke the key and create a new one.
Next step
Your key is ready. Now connect it to your app:
To understand the security side: Security and permissions
Was this page helpful?
AI Access (MCP)
You connect your store to an AI app and then ask about your store data in everyday sentences, such as "list the products running low on stock".
Claude Desktop and claude.ai
You do not paste a key here; you give Treyza's address only, and you pick the store and the permissions yourself on the Treyza consent screen that…