API and machine access
Scoped API keys
Autessa client API keys let your applications run the tools, agents and AutessaDB tables you choose. Every key belongs to the person who created it and can never reach more than they can. Each carries its own scope, with READ, WRITE and DELETE per table, per-minute and per-day rate limits, an optional allowed-origins list, and acts as its owner or with its own role.
The problem
What problem does it solve?
A single all-powerful API key shared across integrations is the most common path to a data breach. One key per integration, scoped to exactly what it needs, keeps a leak small and revocable.
How it works
- 1
Create the key
API Management → API Keys → Create API Key. Name it after the integration.
- 2
Set limits and origins
Requests per minute (default 60) and per day (default 5000). Add allowed origins if a browser app you control calls it.
- 3
Choose how it acts
Acts as you (row rules apply as they do to you) or Its own role (sees only what its AutessaDB roles allow).
- 4
Scope the resources
Pick specific tools, agents and tables, with READ, WRITE and DELETE per table. Copy the key once; it is not shown again.
Every option
Scoped API keys: settings and options
| Setting | What it does |
|---|---|
| Resource access | All resources you can reach, or a hand-picked set of tools, agents and tables. |
| Per-table operations | READ, WRITE, DELETE. WRITE or DELETE needs WRITE on the table yourself. |
| Acts as | Acts as you, or Its own role. Keys with allowed origins must use their own role. |
| Word of the day | A separate permission to read your company’s word of the day through the firewall API. |
| Enable / Reset token / Delete | Pause without rotating, rotate immediately, or delete permanently. |
| Usage | Total, successful and failed requests by endpoint, agent and tool, plus a transaction history. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Owner | Everything, including rotation. |
| Key Viewer | See settings and usage, never the secret. |
| Key Editor | Narrow the key, never widen it. |
| Key Admin | Rotate, share, widen and delete, only if they can reach everything the key can. |
| Company Admins | See every key, and disable or delete any key; rotation follows the same reach rule. |
FOR DEVELOPERS
What to know
- Every request is checked again against the owner’s access at that moment. If the owner loses access, the key does too; if the owner leaves the company, the key stops working.
- Allowed origins are a hardening layer, not a substitute for secrecy. Keep keys on a server.
- Legacy keys with no owner cannot read protected fields; an Admin can claim, disable or delete them.
Connections
How Scoped API keys connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
Scoped API keys: questions
Can an API key read more data than I can?
No. Everything you pick is checked against your own access when you save, and every request is checked again at that moment.
Can I give a key read-only access to one table?
Yes. Scope it to that table and tick only READ.
Can I see the key again after creating it?
No. It is shown once. Reset token issues a new value and invalidates the old one immediately.
Get started with Scoped API keys
Every Autessa API key belongs to a person, carries its own scope, rate limits and allowed origins, acts as its owner or with its own role, and is re-checked against the owner on every request.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours