Create a key for one integration
Open Settings → API Keys. Use a descriptive name for the integration or agent so you can identify it later. Select the required permissions and content types.
Choose the minimum permissions
read: read workspace content, runs and the topic map.write_content: create and update content.run_autopilot: crawl, research and start runs.publish: publish approved drafts.admin: administrative actions such as invites and exports.
Protect and revoke keys
Store keys server-side or in secure agent configuration. Do not include them in frontend bundles. Revoke a key when an integration is retired or a key is exposed, then replace it in the connected system.