Skip to main content
Scoped customer API keys are coming. Key creation, scope selection and key-management operations are not available yet. The existing personal api_access_token is a legacy token, not a scoped key.
For a server integration today, follow Authentication. OAuth access for AI clients and MCP connections are also coming.

​
Planned key lifecycle

Scoped keys are being built for one account and an assigned principal, including service users. Their planned lifecycle includes choosing scopes and expiry, displaying the key once, rotating it, revoking it and tracking last use. These capabilities will be documented with their shipped API operations. There is no customer key-management dashboard or key-creation API workflow to follow on this page yet. Keep existing tokens on your server. Preparing to migrate does not require placing a token in a browser or sending one to a new authentication endpoint.

​
Scopes — coming

The planned permission model combines the user’s role, the credential’s scopes and the customer’s connector opt-ins. A scoped credential cannot grant more access than its user has. See the worked examples on Authentication. The scope reference will be generated from the enforced scope registry and operation register. Those sources are not available yet, so this page does not publish a hand-written list of scope names or pretend that legacy tokens support scope selection.

​
Configured limit defaults

The following defaults are committed configuration for the coming scoped-key system. They are not active customer-key enforcement and do not replace the current rate-limit behavior. The daily request quota is unset. A key-limit override can only lower the per-key limit; it cannot change account limits or the window. These configuration rules do not mean an API key can already authenticate a request.

​
Provider outages — coming contract

The planned scoped-key outage behavior allows reads from a verification cache no older than 60 seconds and refuses writes when verification is unavailable. This is a design for the coming key verifier, not a guarantee made by the current legacy-token path. The client-visible error code will be documented when that verifier and its error contract ship; no future error code is invented here.

​
Migration and availability

There is no announced legacy-token sunset date. Follow the current legacy-token migration guidance while key management, the generated scope reference and scoped request enforcement are completed. The dashboard is not a prerequisite for server key management: API documentation will accompany the API when it ships. This page does not show an unbuilt dashboard or suggest that a key has already been issued.

​
Next