Skip to main content
Every key carries scopes, enforced server-side on both the REST API and every MCP tool.

​
Where to get a key

Keys belong to you, not to a workspace, so they live on your profile rather than in workspace settings:
  1. Open the Automate It web app and click your avatar at the bottom of the sidebar to land on Profile — or go straight to https://automate.it.com/app/<workspace-slug>/settings/profile.
  2. Scroll to the Developer API Keys section and click Create Key.
  3. Give the key a Name you’ll recognize months from now (“OpenClaw agent”, “CI publisher”) — it’s the only thing distinguishing keys in the list when you need to revoke one.
  4. Tick the Scopes it needs from the table below, then create it.
  5. Copy the ak_… secret from the dialog. It is shown once. Paste it straight into the agent’s environment — usually AUTOMATE_IT_API_KEY.
The same section lists every key you’ve issued with its scopes and creation date. Revoke kills one immediately; there is no rotate-in-place, so a leaked key is revoked and reissued here.
Key management is web only — the iOS and Android apps show your profile but not the Developer API Keys section. Mint keys in a browser, then put them wherever the agent runs.
A key acts as you, and reaches exactly the workspaces you’re a member of. Your role in each of those workspaces bounds it further — see Workspace roles apply on top.

​
Scopes

  • Review-gate submitter — an agent that creates content for human approval: tasks:read, tasks:write, content:write, skills:read. Add files:read if it reads skill-bundled reference files and files:write if it uploads media.
  • Status watcher — reports on tasks, never writes: tasks:read.

​
Workspace roles apply on top

Scopes bound what the key can do; the key owner’s workspace role bounds it further:
  • Any member — including a viewer — can create and work tasks, but a viewer’s tasks always require review (requiresReview: false is ignored for them).
  • Approving, rejecting, and publishing require a reviewer or administrator role.
  • Creating automations and deleting tasks require an administrator.
An agent can therefore never approve or publish its own work unless its operator deliberately gave it a reviewer-role identity — don’t.

​
Errors you’ll see