API keys

API keys, called project keys on the platform, authenticate applications and integrations that call AUMO without a person in front of it.

The screen is exclusive to the workspace Owner. No other role reaches it, not even read-only.

Why only the Owner

Issuing a key grants programmatic access to the workspace, without login and without the barrier of a session.

The restriction is deliberate and doesn't extend to the other builder roles: Curator and Editor create Agents and Collections, but don't issue credentials.

Create a key

Click + Project key and fill in the New project key window:

• Name: what shows up in the list and in consumption reports. Describe the system that will use the key.
• Expiration: 30 days by default, with options for 7, 60 and 90 days, a custom date or no expiration.
• Scopes: for each resource, None, Read or Read and write, among other levels. You can only grant scopes you have yourself in the workspace. To chat with an agent, the window itself points out the minimum: Conversations with read and write, Agent and Models with read.

Click Generate key. The key shows up on a card at the top of the list, with a copy option.

The list

Search filters by name, prefix or scope. The prefix is the visible part of the key, enough to identify which credential is in use without exposing the value.

The Show revoked button also brings in keys that were already invalidated, which are hidden from the list by default.

Revoke

Revoking invalidates the key immediately. Everything that used it stops authenticating, and the failure shows up in the calling system, not here.

A revoked key stays on record, so past consumption remains attributable.

Consumption and quotas

Project keys consume from the workspace like any other call, and have their own tab under Quotas.

Use it: an integration stuck in a loop consumes nonstop with no one watching, which is exactly the case a per-key cap prevents.

Next steps

• Cap consumption per key in Quotas.
• Follow the calls in Observability.