Skip to main content

API Keys

Client API keys let your applications execute the resources you've built on Autessa — run tools, chat with agents, and read or write AutessaDB tables through the Client API. Each key carries its own resource scope, rate limits, and optional origin allow-list, so a production integration touches exactly what you intended and nothing else.

What it's for​

A client key is the credential you hand to your own backend (or a partner's) so it can use what you've published — as opposed to a poweruser key, which manages your workspace. Because scope, limits, and origins are set per key, the right pattern is one key per integration: a narrowly scoped key for the website chatbot, another for the data pipeline, each revocable on its own.

Open API Management → API Keys in the sidebar (the section appears when your role has API access). The page lists your keys in a table — name, truncated key ID, Enabled/Disabled status, an All resources/Scoped badge, this month's request count, and success rate. Expanding a row shows detailed usage stats with View History, Reset Token, and Edit actions; the kebab menu on each row also offers Edit, Reset token, View details, and Delete.

Key concepts​

  • The key is shown once. After Create API Key, the full key value appears a single time with a Copy button — it cannot be retrieved later. Requests pass the raw key in the Authorization header (no Bearer prefix); WebSocket endpoints take it as an ?authorization= query parameter instead. See Authentication.
  • Resource access — a key either has access to all resources in your account or a hand-picked scope across three resource types: Tools, Agents, and AutessaDB Tables. Within each type you can grant everything (e.g. "All Tools") or tick individual resources.
  • Per-table permissions — every AutessaDB table in a key's scope carries its own READ, WRITE, and DELETE checkboxes (or one set of operations applied to all tables), so a key can read a catalog table while being unable to modify it.
  • Rate limits — each key sets Requests per Minute (default 60) and Requests per Day (default 5000). Requests beyond the limit are rejected until the window resets.
  • Allowed origins — an optional allow-list of web origins (e.g. https://app.example.com, http://localhost:3000). Leave it empty to accept requests from anywhere; add entries to restrict. Origins are exact scheme + host + port — wildcards aren't supported.
  • Usage stats, not just logs — the expanded row shows total, successful, and failed requests with per-endpoint, per-agent, and per-tool breakdowns; View History opens the full transaction log.

Origin restrictions are a hardening layer, not a substitute for secrecy — the key itself still belongs on a server, never in client-side code.

How to create an API key​

  1. On the API Keys page, click Create API Key.
  2. Name the key after the integration it serves and add a description. Leave Enable this API key checked.
  3. Set the per-minute and per-day rate limits, and add allowed origins if the calling app runs in a browser context you control.
  4. Under resource access, uncheck Grant access to all resources in your account and select the specific tools, agents, and tables the integration needs — including READ/WRITE/DELETE per table.
  5. Click Create API Key, then copy the key value from the success screen. It will not be shown again.

How to rotate a key​

  1. Open the key's row menu and choose Reset token (or Reset Token in the expanded detail panel).
  2. Confirm the warning — the old token is invalidated immediately, so anything still using it will stop working.
  3. Copy the new key value from the success screen and update every application that used the old one. The key keeps its ID, scope, limits, and stats; only the secret changes.

To pause a key without rotating, uncheck Enable this API key in Edit; to remove it permanently, choose Delete (irreversible).

The in-app API docs​

The builder ships a quick-start reference at /keys/docs covering exactly what client keys can call: POST and WebSocket variants of tool execution and agent execution, with request formats, streaming message shapes, audio notes, and copyable cURL and JavaScript samples. For the complete endpoint reference, use the Client API docs.