---
title: "Create a project key – Relyo"
description: "Create a Relyo project key yourself, no account needed: via the MCP server for coding agents or via the API. Origins, manage token, limits."
lang: en
canonical: https://relyo.de/en/docs/project
---

# Create a project key

A project key (`projectKey`) connects your website or app to relyo.de. You create it yourself, with no account and no email: through your coding agent via the MCP server, via the API, or with a single `curl`.

Creating a project returns two values:

- **`key`** (`pk_…`): public, goes into `Relyo.init({ projectKey })`.
- **`manageToken`** (`rpm_…`): secret, **shown only once**. You need it to change origins and the name, rotate the key or delete the project. Keep it in a password manager or secret store, never in code or the repository.

## With a coding agent (MCP)

relyo.de runs an MCP server at `https://relyo.de/mcp` (Streamable HTTP, no sign-in). Add it to Claude Code like this:

```sh
claude mcp add --transport http relyo https://relyo.de/mcp
```

Other agents (Cursor, VS Code, Windsurf …) add it to their MCP configuration:

```json
{
  "mcpServers": {
    "relyo": { "type": "http", "url": "https://relyo.de/mcp" }
  }
}
```

Then just ask, for example: “Use the Relyo MCP server to create a project for https://example.com and add Relyo.” The server offers these tools:

| Tool                 | Effect                                                  |
| -------------------- | ------------------------------------------------------- |
| `create_project`     | create a project, returns `key` and `manageToken`       |
| `get_project`        | show the project                                        |
| `update_project`     | rename it or replace the list of origins                |
| `rotate_project_key` | issue a new key; the old one stops working immediately  |
| `delete_project`     | delete the project; the key stops working, sessions end |

## Via the API

```sh
curl -X POST https://relyo.de/api/projects \
  -H 'content-type: application/json' \
  -d '{"name": "My shop", "origins": ["https://example.com", "https://www.example.com"]}'
```

Response (`201`):

```json
{
  "key": "pk_3f9c0a71d2e84b5c6a10",
  "name": "My shop",
  "origins": ["https://example.com", "https://www.example.com"],
  "limits": { "maxSessions": 3, "maxSessionMinutes": 60, "idleMinutes": 10 },
  "createdAt": "2026-10-25T13:00:00.000Z",
  "updatedAt": "2026-10-25T13:00:00.000Z",
  "manageToken": "rpm_…"
}
```

Manage it with the `manageToken` as a bearer token:

| Request                        | Effect                                                |
| ------------------------------ | ----------------------------------------------------- |
| `GET /api/project`             | show the project                                      |
| `PATCH /api/project`           | change `name` and/or `origins` (the list is replaced) |
| `POST /api/project/rotate-key` | issue a new key, the token stays                      |
| `DELETE /api/project`          | delete the project                                    |

```sh
curl -X PATCH https://relyo.de/api/project \
  -H "authorization: Bearer $RELYO_MANAGE_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"origins": ["https://example.com", "https://staging.example.com"]}'
```

The full description is available as [OpenAPI](/openapi.json).

## Origins

- **Websites:** add every address the SDK loads from, meaning scheme, host and port without a path (`https://example.com`, `https://www.example.com`, `http://localhost:5173` for development). At most 20.
- **Flutter and native apps** send no origin and need no entry. A project without origins works for apps only.
- If a page connects from an origin that is not listed, relyo.de rejects it and the SDK shows “Der Support-Code konnte nicht angefordert werden.” (the support code could not be requested).

## Limits on relyo.de

Self-created projects use the free demo service without warranty (see [terms of use](/en/nutzungsbedingungen)):

- at most 3 concurrent sessions per project, each at most 60 minutes, ending after 10 minutes without activity;
- sessions start only via the code the user reads out (no device list);
- at most 10 new projects per hour and address.

The response lists the current values under `limits`. If you need more, run the relay yourself.

## Lost or leaked key

The key is part of your website's or app's code anyway; it is not a secret. The list of origins stops other websites from using it. To replace it anyway, use `rotate_project_key` or `POST /api/project/rotate-key` and ship the new key.

If you lose the `manageToken`, the project can no longer be changed. Create a new one instead.