For code that runs without you

API keys

One key authenticates everything Pixero exposes over HTTP: the MCP server and the competitor ads endpoint. Keys act as you, so a key can do whatever your account can do, bounded by the scopes you give it.

Create a key

Label, so you can tell keys apart laterIntegration this key acts forA key bound to an integration can only reach that integration's ad account and Page. Left unbound, it inherits every ad account on your Meta connection. A new integration is bound by the guided setup your assistant runs after you connect, and can attach to an agency you already have.

Scopes this key may use

readBrands, performance, competitor adsgenerateImages and video, spends creditsdeployPublish and manage Meta campaignsagentDelegate work to the Pixero agentplatformYou run ads for your own customers. Adds the agency tools; leave off if the ads are your own

Your keys

One key, both surfaces

A pxr_ key is a bearer token. The same value works against the MCP server and the REST endpoint, because both authenticate through the same path and the REST route is a thin wrapper over the same tool.

Shell

curl "https://pixero.ai/api/v1/ads/search?brand=Ridge%20Wallet" \
  -H "Authorization: Bearer pxr_your_key_here"

HTTP request

POST https://pixero.ai/api/mcp
Authorization: Bearer pxr_your_key_here
Content-Type: application/json
Accept: application/json, text/event-stream

Connect it to Claude Code

Pass the key as a header when you add the server. This is the flow to use for a platform integration, because the setup tools act as the key rather than as whoever happens to be signed in.

Claude Code

claude mcp add pixero --transport http https://pixero.ai/api/mcp \
  --header "Authorization: Bearer pxr_your_key_here"

Replace pxr_your_key_here with the key you just created. Run it in the directory you want to work in, then check it with claude mcp list, which should show pixero as connected.

Codex

export PIXERO_API_KEY=pxr_your_key_here

codex mcp add pixero \
  --url https://pixero.ai/api/mcp \
  --bearer-token-env-var PIXERO_API_KEY

Codex takes the name of an environment variable rather than the key itself, and reads it each time it starts. Export it in the same shell, and put it somewhere permanent (your shell profile, or a .env your shell loads) or the connection will work now and fail tomorrow with an empty token. Check it with codex mcp list.

The key needs the platform scope. It is off by default, because most keys are for running your own ads. Without it the setup tools are not in your assistant's hands at all, and it will tell you it cannot find them rather than that the key is wrong.

Using Pixero from claude.ai instead is a different flow: it signs you in with OAuth and never sees a key, so nothing on this page applies there.

What the scopes mean

Scopes are checked per tool call, not per key exchange, so a key that lacks deploy fails at the launch call rather than at connect time. Give a key only what its job needs.

read covers brand memory, workspaces, synced Meta performance, and competitor ad research. generate adds image and video generation, which spends credits. deploy adds everything that touches Meta: publishing, activating, pausing, lead forms, lead destinations, and workspace settings. agent lets a key delegate open-ended work to the Pixero agent. platform adds the agency tools you need to run ads on behalf of your own customers: the setup questionnaire, client brand workspaces, vendor status and budgets, and embed tokens.

A platform integration needs all five, and platform is the one you have to ask for. It is off by default because it does not widen what a key can do to your own ads, so a key minted without it simply will not see the agency tools at all. Reading is free, generation spends credits, and every call that creates or activates real delivery still takes an explicit confirmation flag, so a broad key is not a blank cheque.

Limits and handling

Keys are rate limited to 60 calls per minute each, and you can hold up to 10 active keys. Over the limit you get a 429, so back off and retry.

Keys are stored hashed. The plaintext appears once, at creation, and cannot be recovered afterwards, only revoked. Revoking takes effect immediately. Treat a key like a password: keep it server side, out of client bundles, and out of version control.