Skip to main content
Workspace secrets let you create and manage API keys for programmatic access to your workspace. Use these keys to deploy apps, provision app users, or create sign-in tokens for embedded apps. On the Enterprise plan, you can also use them to stream audit logs, pull workspace data through the Monitoring API, and read or manage users over SCIM. These aren’t included in the Business plan. Each key carries only the permissions you give it. Keys are workspace-owned, so they stay active even if the member who created them leaves the workspace.
Who can use workspace secrets:
  • Plan: You need an Enterprise plan (Business or Enterprise) to use workspace secrets.
  • Role: Only workspace owners and admins can view and manage secrets.
The Secrets page listing a workspace API key and its status

Workspace API keys on the Secrets page

For a full list of supported APIs, see the API reference.

Creating an API key

You can create up to 10 API keys per workspace.
Keep your key safe:
  • Copy your key immediately after creating it. You can’t see it again.
  • Treat it like a password. It grants access to your workspace data via the API.
To create an API key:
  1. Click your workspace name at the bottom left and click Settings.
  2. Click Secrets in the sidebar.
  3. Click + Create API Key.
  4. Enter a name for the key.
  5. Choose what the key can access. See Choosing permissions for what each option grants.
    • To give the key specific scopes, select the scopes it should have. If you select a permission that works on apps, such as Deploy apps, choose which apps the key can reach under App access.
    • To give the key workspace-wide access, click Use workspace-wide access instead, then choose an access level:
      • Read-only: The key can read data through every API that accepts workspace API keys, but can’t make changes. This option is selected by default.
      • Full access: The key can read data and make changes through every API that accepts workspace API keys.
    A screenshot of the Create API Key dialog with the Read-only and Full access options outlined below the warning

    Choosing workspace-wide access for an API key

  6. (Optional) Enter a description.
  7. Click Create Key.
  8. Copy the key and store it somewhere safe.
  9. Click Done.
Create API Key dialog with permission checkboxes

Choosing an API key's permissions

Choosing permissions

Each API key gets its access in one of 2 ways. It either has specific scopes, which allow only the tasks you pick, or workspace-wide access, which reaches every API that accepts workspace API keys on your plan. Specific scopes are the default.

Choosing specific scopes

Scopes are individual permissions that control which parts of your workspace a key can access. Give a key only the scopes the integration needs. For the Deploy apps, Provision app users, Mint embed sign-in tokens, and Watch app builder updates permissions, choose which apps the key can access:
  • Selected apps: The key can only access the specific apps you choose.
  • All current and future apps: The key can access any app in the workspace, including apps you add later.

Using workspace-wide access

Workspace-wide access lets a key use every API that accepts workspace API keys, with the same permissions as the workspace owner, so you don’t pick scopes one by one. It always covers every app in the workspace, including apps you add later. Your audit logs record the key’s actions under the key, along with the owner it acted as. Use it for a trusted integration of your own that works across your whole workspace, such as an internal tool that manages all your apps. You choose one of 2 levels:
  • Read-only: The key can read data through those APIs but can’t make changes, such as deploying apps, giving people access to apps, creating sign-in tokens, or changing SCIM users.
  • Full access: The key can read data and make changes through those APIs.
Workspace-wide access isn’t least privilege. The key can do far more than one task, so if it leaks, far more of your workspace is exposed. Choose specific scopes when the integration only needs a few tasks, when it should only reach some of your apps, or when you’re giving the key to someone outside your company.
You can change a key’s scopes or access at any time by editing it from the Secrets page.

Managing your API keys

From the Secrets page, you can view all your keys along with each key’s access, who created it, when they were created, and when they were last used. Click the More actions icon next to a key to edit, disable, or delete it.
Creating, editing, enabling, disabling, and deleting a key are all recorded in your workspace audit logs, and actions taken with a key are attributed to it.
To manage an API key:
  1. Click your workspace name at the bottom left and click Settings.
  2. Click Secrets in the sidebar.
  3. Click the More actions icon next to the key you want to manage and select an option:
    • Edit: Update the key’s name, description, permissions, or access.
    • Disable key: Temporarily prevent the key from being used without deleting it.
    • Enable key: Re-enable a previously disabled key.
    • Delete key: Permanently remove the key. This cannot be undone, and anything using that key stops working straight away.
An API key's More actions menu with Edit, Disable key and Delete key

Managing an existing workspace API key

Blocking personal account API keys

Some members of your workspace may still have an older personal account API key. When you block these keys, only workspace API keys, which admins create and manage, can reach your workspace’s apps and data.
How this works on your plan:
  • Enterprise: Personal account API keys work in your workspace until you block them.
  • Business: Personal account API keys are always blocked, even when Block account API keys is off. Any script, integration, or MCP client that uses one needs a workspace API key or a personal access token instead.
You can block personal keys whether or not your workspace uses SSO. It’s especially useful if you require SSO for all workspace members, because it closes the gap between how people sign in and how they can reach your data programmatically.
Before you turn this on:
  • The setting shows how many requests used a personal account API key against your workspace in the last 30 days, and how many members are actively using their keys, so you can see who this affects. You can review the full list in your audit logs.
  • Workspace API keys are not affected, so anything built on an admin-managed key keeps working.
  • App users signing in to your published apps aren’t affected.
To block personal account API keys:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Governance.
  4. Turn on Block account API keys.
The Block account API keys setting outlined on the Governance page

Blocking personal account API keys for your workspace

Governing personal access tokens

Members can create personal access tokens to let their own scripts and tools reach your workspace’s apps. A token acts as the member who made it and never exceeds their own permissions, and it stops working when they leave the workspace. As an admin you decide whether tokens may be used in your workspace at all, and how much a token is allowed to do. The controls sit in the Enable personal access tokens card on the Governance page, and every member token created for the workspace is listed in Secrets.
What to know before you set a policy:
  • You need an Enterprise plan (Business or Enterprise) to govern members’ tokens. Creating and using tokens works on every plan, so without this control members can still make them.
  • Turning the card off suspends every member token immediately. Nothing a member built on one works until you turn it back on.
  • Tightening a limit doesn’t break tokens retroactively. A token that no longer fits is marked Doesn’t meet policy and keeps working until someone disables it, so you choose when to cut it off.
  • A member can’t re-enable a token that misses the policy, and can’t pick an option the policy doesn’t allow when creating a new one.

Setting the access token policy

The card carries a switch for tokens as a whole, and 2 limits that cap what any token may be. Each limit names the most a token is allowed to be, so choosing Read-only means nobody can create a token that changes data.
The Enable personal access tokens card on the Governance page, with its 2 limits

The access token policy on Governance, with the limits that cap what a token may be

To set your access token policy:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Governance.
  4. Turn the Enable personal access tokens toggle on or off.
  5. Next to Permission, choose the most a token may do: Full access or Read-only.
  6. Next to Access, choose how much of the workspace a token may reach: All apps and Superagents or One app or Superagent.

Reviewing members’ access tokens

The card’s footnote counts the member tokens that meet your policy and links straight to the full list. In Secrets, the Personal access tokens in this workspace table is admin only, and shows each token’s owner, access, permission, status, and when it was last used. You can disable or delete any of them, but you cannot change one, since it belongs to the member who made it.
The admin token table's Filters panel, including the Meets policy filter

Filtering member access tokens, including by whether they meet your policy

To review and act on members’ access tokens:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Secrets, then click the Personal access tokens tab.
  4. Under Personal access tokens in this workspace, click Filter to narrow the list by permission, last used, status, or whether a token meets your policy.
  5. Next to a token, click the More actions icon and click Disable or Delete.