Skip to content
Jetrepo
Esc
↑↓navigate↵open⌘Jpreview
On this page

Create API keys

Create and rotate scoped delivery, preview, or agent credentials.

API keys are Organization-owned service principals. Create one credential for one consumer and copy its secret once.

Create a key

  1. Open Settings for the selected Backend, follow Organization keys, and choose Create Organization key.
  2. Enter a name and choose Delivery Published, Delivery Preview, or Agent.
  3. For an Agent key, select only the required permissions and explicit All or Selected resource scopes. Its Backend is fixed to the current Backend.
  4. Choose Never, 7 days, 30 days, or 90 days, create the key, and immediately store the displayed secret.

The page requires backend.read. Listing keys uses apiKey.read; creating, changing policy, and revoking use apiKey.create, apiKey.update, and apiKey.delete respectively.

Let a delegated agent request a Delivery key

An OAuth or Agent Auth client acting with a signed-in human’s live apiKey.create permission can propose organization_key.create@1 through Management MCP. Delegated requests are limited to Delivery Published or Delivery Preview keys with explicit Backend and Environment scopes. They always require human Approval in Changes, regardless of the Backend’s publication policy.

The requesting client calls execute to create the Approval-waiting Operation. After an authorized human approves it and execution reaches SUCCEEDED, that client calls control_operation with CLAIM_SECRET. The claim is bound to that same delegated credential, expires shortly, and succeeds only once. Candidate, Operation, and audit evidence contain the key ID and claim availability, never the plaintext secret. Store the claimed secret immediately.

Organization-owned Agent keys cannot request or claim another credential. Changing policy and revoking keys remain human administration tasks.

Delivery keys receive only delivery.readPublished or delivery.readPreview and require explicit Backend and Environment scopes. They do not use Data Type, Locale, or Vocabulary scopes. Alias restrictions may narrow which stable delivery names a key can resolve.

Agent keys can receive only backend.read; environment.read, environment.create, environment.branch, or environment.checkpoint; promotion.read, promotion.create, promotion.resolve, or promotion.execute; model.read; content.read, content.publish, or content.unpublish; vocabulary.read; term.read; release.read, release.create, release.update, or release.schedule; and operation.read, operation.execute, operation.cancel, or operation.retry. Canonical proposal and execution still require every underlying Operation Definition permission, so generic Operation access never expands the key’s domain permissions. Agent keys cannot author or delete Content/model resources, execute or roll back a protected Promotion, override protection, or request Alias Cutover.

Govern agent connections

Open Organization management → Connections to inspect OAuth Management MCP apps and Agent Auth identities separately. Any signed-in Organization member may inspect and revoke only their own delegated connections. OAuth rows show the registered client, Organization scope, management intent, authorization time, last successful use, and revocation. Agent Auth rows show identity status, delegated mode, host, expiry, every capability grant, constraints, and separate identity or grant revocation. Live roles and narrower Backend/Environment scopes continue to apply to both methods.

Older OAuth grants created before Organization-bound consent appear as Reconnect required. Reconnect from the MCP app to choose the Organization and approve explicit management intent. Revoke connection removes consent, revokes its persisted access and refresh credentials, and makes self-contained access tokens fail on the next Management request.

Revoke grant removes one capability immediately. Revoke agent invalidates the whole Agent Auth identity; the next request and queued execution revalidation fail. Organization-owned service keys remain separately governed under Organization keys with apiKey.read/apiKey.update/apiKey.delete.

Rotate a key

Create a replacement, deploy and test it, then revoke the old key. Delivery and Agent configurations are not interchangeable, and the secret cannot be displayed again.

Was this page helpful?