> ## Documentation Index
> Fetch the complete documentation index at: https://docs.automate.it.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys & scopes

> Least-privilege keys for agents, enforced on both REST and MCP

Create keys in the Automate It app under **Profile → API keys**. The secret (`ak_…`) is shown once — copy it into the agent's environment immediately, and revoke and reissue from the same screen if it leaks.

Every key carries scopes, enforced server-side on both the REST API and every MCP tool.

## Scopes

| Scope                                    | Enables                                                                                                                                      |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `tasks:read`                             | List and inspect tasks, published-post links, the review queue                                                                               |
| `tasks:write`                            | Create, claim, complete, comment on, approve, reject, publish, delete tasks                                                                  |
| `content:read`                           | Read task content items                                                                                                                      |
| `content:write`                          | Attach and revise task content — including one-shot submit (`create_task` with `content`), which needs this **in addition to** `tasks:write` |
| `files:read`                             | Browse workspace files, mint presigned download URLs, list folders                                                                           |
| `files:write`                            | Presigned upload URLs, folder mutations                                                                                                      |
| `skills:read`                            | Read workspace skills (voice, formatting rules, bundled reference files)                                                                     |
| `skills:write`                           | Create and update workspace skills                                                                                                           |
| `workspace:read`                         | Read workspace details and membership                                                                                                        |
| `automations:read` / `automations:write` | Read and manage automations, including triggering a run                                                                                      |
| `*`                                      | Full access — every scope above                                                                                                              |

## Recommended bundles

* **Review-gate submitter** — an agent that creates content for human approval: `tasks:read`, `tasks:write`, `content:write`, `skills:read`. Add `files:read` if it reads skill-bundled reference files and `files:write` if it uploads media.
* **Status watcher** — reports on tasks, never writes: `tasks:read`.

## Workspace roles apply on top

Scopes bound what the *key* can do; the key owner's workspace role bounds it further:

* Any member — including a **viewer** — can create and work tasks, but a viewer's tasks always require review (`requiresReview: false` is ignored for them).
* Approving, rejecting, and publishing require a **reviewer** or **administrator** role.
* Creating automations and deleting tasks require an **administrator**.

An agent can therefore never approve or publish its own work unless its operator deliberately gave it a reviewer-role identity — don't.

## Errors you'll see

| Error                                     | Meaning                                                                    |
| ----------------------------------------- | -------------------------------------------------------------------------- |
| `MCP HTTP 401`                            | Key missing, mistyped, or revoked                                          |
| `missing required scope: …`               | The key lacks that scope — reissue with the right scopes; don't retry      |
| `Only reviewers and administrators can …` | Role limit, not a scope limit — the operation needs a human with that role |