Scoped & Expiring API Keys

An API key used to be all-or-nothing: every key could do everything the account could. Now you choose exactly what a key is allowed to do, and how long it lives.

Pick what a key can do

When you create a key under Settings, you choose its scopes, grouped by resource — conversations, agents, rules, skills, tools, automations, vaults, channels, and integrations. A few things make least-privilege the easy default:

• Read-only to start. Each resource's read scope is pre-selected; the write, delete, and deploy scopes are opt-in.
• Write includes read. Tick a resource's write scope and its read is checked and locked automatically — a key that can edit agents can obviously also see them.
• Secrets are held back. The scope that exposes plaintext secret values is never included by default. You add it deliberately or not at all.
• A key can't out-rank its creator. You can only grant scopes you hold yourself.

Set an expiry

Give a key a lifetime at creation — 30 days, 90 days, a year, or never. Requests with an expired key are rejected outright.

Existing keys keep working unchanged. If a key hits an endpoint it isn't scoped for, the request is declined with a clear permission error instead of running.