API keys and permissions

Create keys with full access, or limit a key to exactly the endpoints an integration needs.

API keys authenticate the public API. Every key belongs to your workspace and acts on its data.

Full access or custom

Full access — the key can call every public endpoint.
Custom — the key can call only the permissions you tick.

Give every integration its own key, with only what it needs. A key that can only read call history cannot place calls if it leaks, and revoking it breaks one integration rather than all of them.

Permissions

Area	Permissions
Call jobs	list, read details, read rows, create, update, delete
History	read call history, chat history, chat sessions, generated calls
Outbound	trigger calls, trigger chats
Live injections	inject into calls, inject into chats
Flows	read, read details, create, update, delete
Agents	read agents; read and write agent knowledge bases
Tools	read, create, update, delete
Structured outputs	read, create, update, delete
Phone numbers	read, create, update, delete
Applications and data stores	read applications; read and write data stores
Account	read balance
Reports and artifacts	read tool usage reports, read automation artifacts
Testing	call the test endpoints

Keys are production credentials

Keep keys in a secret store, never in browser or mobile code, and revoke any key that has been pasted somewhere shared.