- OAuth — connect from a browser-capable client (Claude Code, Claude Desktop, Cursor) with no key at all; a browser window signs you in. OAuth sessions act with your full user access, bounded only by your workspace role.
- API key — send
Authorization: Bearer ak_…for headless use. Keys are additionally bounded by their scopes.
The 44 tools
Scope applies to API-key connections; role checks apply to everyone.Workspace & identity
Tasks
Content
add_content_to_task takes either one post (title, body, contentType, media, sortOrder, outputType) or items, an array of posts with those same fields — a thread is one call whose items carry sortOrder 0, 1, 2…, and a multi-platform task is one call with an item per platform. A batch is all-or-nothing: every item is validated first, one bad item means nothing is added and the reply names each bad item by index (item 2 (threads, sortOrder 2): …), and items that omit sortOrder are numbered by position within their contentType. Do not combine items with the single-post fields. Media is addressed by workspace fileId, from get_upload_url; a URL is not accepted. The reply lists the id of every created item. From the CLI: ait task add-content <taskId> --items '<json array>'.
Automations
Skills, files & folders
Tools like
search_web, search_x, and generate_image belong to the built-in worker’s in-sandbox toolset — they run while it drafts content and are not exposed on the public MCP server. If your agent needs research or image generation, bring its own.The gate is role-based, not scope-based
A Viewer-role key holdingtasks:write still cannot approve, reject, or publish — those tools check the caller’s workspace role independently of key scopes, and a Viewer’s created tasks always require review. Scopes bound what a key may touch; roles decide who may ship. Keep agent keys on Viewer identities and the review gate holds no matter how the key is scoped.