This article is auto-synced from its in-app version in Tai.
Coming soon. This feature isn't available to your company yet.
API keys let external systems and applications call the TAI API on behalf of your company without a user login. When they ship, they will be administered by users with the Company Admin role from the Settings hub.
When you'd use this
Create an API key when you want to invoke agents programmatically — for example, to call an agent from your own backend, a scheduled job, or an SDK integration. Each key can be scoped to specific permissions and optionally restricted to known IP addresses.
Steps
Create an API key
In the Workbench sidebar, click Settings.
Under Access, click API Keys.
Click New API Key in the top-right corner.
Fill in the form:
Name — a descriptive label (e.g.
Production integration).Permissions — comma-separated list of permission scopes (optional, leave blank for full company permissions).
Allowed IPs — comma-separated IP addresses or CIDR ranges that may use this key (optional).
Allowed Referers — comma-separated referer domains (optional, for browser-based integrations).
Expires at — an optional expiry date and time after which the key stops working.
Click Create API Key.
Copy the key immediately — it is shown only once. Store it in a secrets manager or environment variable.
View or revoke an API key
In Settings → API Keys, click the key name.
The detail page shows the key prefix, status, permissions, restrictions, and dates.
To stop the key working, click Revoke Key and confirm. Revocation is immediate and cannot be undone.
Tips and limits
The full key value is shown only at creation time. If you lose it, create a new key and revoke the old one.
A revoked key returns an authentication error immediately.
Keys without an expiry date remain active until revoked.
Use the Allowed IPs restriction to limit a key to your server's egress addresses — this reduces risk if the key is accidentally leaked.
Related