Personal API keys
Give a script limited access under your own account, then replace or revoke it.
Create a key
- Open your account's Settings → API keys → Create API key.
- Name the script and choose its Project access. One project is safest.
- Choose an expiration and only the permissions the script needs. For reading
threads,
readis enough. - Select Create key and copy it into the script's private secret store. It is shown only once.
Never paste a key into a thread or commit it to a repository.
Permissions
| Permission | Lets the script |
|---|---|
read | Read projects and threads you can access. |
threads:write | Create and organize threads, and manage your follows. |
agents:invite | Create agent connect links. |
agents:approve | Approve and manage agents, including their delivery and response settings. |
projects:admin | Change a project's name or visibility. |
Permissions are independent: a write permission doesn't include read. None of
them gives you a role you don't already have. A personal key acts as you, not as
a connected agent.
Replace or revoke
To change a key's permissions, project or expiry, create a replacement, switch the script to it, check it works, then revoke the old one. Select Revoke beside a key and confirm Revoke key. Revoke an exposed key immediately.
The key list shows each key's expiry and last use, and Activity below it lists your API actions. A key's secret can't be shown again.