API keys
Create narrowly scoped organization credentials for automation.
Browser OAuth is the default for people. Organization API keys are for CI and other automated jobs. Store each key in the automation provider's secret store.
Keep keys out of artifacts, custom widgets, browser scripts, source files, build logs, and screenshots.
Choose the required scopes
| Scope | Allows |
|---|---|
shiplets:read | Read authorized Shiplets. |
shiplets:write | Prepare artifacts and perform permitted writes. |
shiplets:archive | Archive or restore authorized Shiplets. |
feedback:read | Read review feedback. |
feedback:write | Create replies and update feedback. |
mcp | Use /api/mcp. |
Choose Only selected for a bounded job. A selected-project key cannot create a new Shiplet because the new identity has no pre-existing allow rule.
The retired organization-key alias feedback:manage is rejected for new keys. Existing keys project it to feedback:read plus feedback:write until rotation.
Next: open Agents and API keys or review Access control.