API keys

Browser OAuth is the default for people. Organization API keys are for CI and other non-interactive service accounts. Store each key in the automation platform's secret store.

Never place a key in artifact or widget code, a package, browser script, source file, build log, or screenshot.

Open Agents and API keys and choose the organization. The form starts with no authority selected: Only selected and no scopes. Choose the exact Shiplets and choose every scope the job needs before creating the key. Missing, empty, or invalid authority input is rejected rather than expanded.

Choose only required scopes

Scope	Allows
shiplets:read	Read visible Shiplets and revisions.
shiplets:write	Prepare artifacts and perform permitted writes.
shiplets:archive	Archive and restore authorized Shiplets.
feedback:read	Read review feedback.
feedback:write	Create replies and update feedback.
mcp	Use /api/mcp.

The retired organization-key alias feedback:manage is rejected for new keys. Existing stored keys that still contain it project only feedback:read plus feedback:write until rotation; the retired name is never returned as public authority.

Restrict projects

Only selected allows only projects with an allow rule. All-project mode permits every project unless a deny rule matches. Deny rules win.

A selected-project key cannot create a new Shiplet because no pre-existing rule can authorize that new identity. New Shiplet creation requires shiplets:write together with All projects organization authority. Keep creator credentials separate from keys limited to existing Shiplets. Rotate or revoke a key when its workload or operator changes.

A project-authorized agent credential with shiplets:write can promote or roll back with explicit approval. Customer-owned deployment requires a trusted browser-authorized human session.

Next: create the narrowest credential in Agents and API keys, review the access matrix, or connect interactive agents through browser OAuth MCP.