ak_…) is shown once — copy it into the agent’s environment immediately, and revoke and reissue from the same screen if it leaks.
Every key carries scopes, enforced server-side on both the REST API and every MCP tool.
Scopes
| Scope | Enables |
|---|---|
tasks:read | List and inspect tasks, published-post links, the review queue |
tasks:write | Create, claim, complete, comment on, approve, reject, publish, delete tasks |
content:read | Read task content items |
content:write | Attach and revise task content — including one-shot submit (create_task with content), which needs this in addition to tasks:write |
files:read | Browse workspace files, mint presigned download URLs, list folders |
files:write | Presigned upload URLs, folder mutations |
skills:read | Read workspace skills (voice, formatting rules, bundled reference files) |
skills:write | Create and update workspace skills |
workspace:read | Read workspace details and membership |
automations:read / automations:write | Read and manage automations, including triggering a run |
* | Full access — every scope above |
Recommended bundles
- Review-gate submitter — an agent that creates content for human approval:
tasks:read,tasks:write,content:write,skills:read. Addfiles:readif it reads skill-bundled reference files andfiles:writeif it uploads media. - Status watcher — reports on tasks, never writes:
tasks:read.
Workspace roles apply on top
Scopes bound what the key can do; the key owner’s workspace role bounds it further:- Any member — including a viewer — can create and work tasks, but a viewer’s tasks always require review (
requiresReview: falseis ignored for them). - Approving, rejecting, and publishing require a reviewer or administrator role.
- Creating automations and deleting tasks require an administrator.
Errors you’ll see
| Error | Meaning |
|---|---|
MCP HTTP 401 | Key missing, mistyped, or revoked |
missing required scope: … | The key lacks that scope — reissue with the right scopes; don’t retry |
Only reviewers and administrators can … | Role limit, not a scope limit — the operation needs a human with that role |