Appearance

API keys and agent guardrails ​

An API key lets the CLI, SDK, MCP server, or REST API act on a workspace. Open API Keys in the sidebar to create, limit, and revoke them. A key plus a workspace ID is all an agent needs, and it never sees your login.

You need api_key.view to open the page, which means Owners and Admins. Creating, editing, and deleting keys need api_key.create, api_key.update, and api_key.delete. The same endpoints are in API keys (authentication).

How do I create an API key? ​

  1. Open API Keys and click Create Key.
  2. Enter a Label such as "Production", "Staging", or "CI/CD". Labels are required and must be under 60 characters.
  3. Copy the key from the dialog. It is shown once. Store it in a secret manager. If you lose it, create a new one and revoke the old one.

Keys start with sk_. The table lists Label, Created, Last Used, and Guardrails for each key.

Your plan caps the number of keys. The limits come from the shared plan configuration.

PlanAPI keys
Free1
Pro5
BusinessUnlimited

How do I revoke an API key? ​

Click the revoke action on the row. The dialog "Revoke API Key" warns that this cannot be undone and that any application using the key will stop working. A toast confirms "API key revoked".

How do I limit what an AI agent can do? ​

Click the guardrails action on a key row. The dialog is titled Agent guardrails. The limits apply to posts created with that key. The dashboard itself is never blocked by them.

SettingWhat it doesAllowed values
Daily post limitMax posts per UTC day through this key. Empty means unlimited.Whole number from 1 to 10,000
Monthly X (Twitter) spend capBlocks posts to X through this key once its estimated X API cost for the month reaches the cap. Resets monthly. The dialog shows spend so far.$1.00 to $1,000,000, entered in dollars
Require approvalEvery post made with this key lands in pending_approval and waits for a teammate.On or off

Active guardrails show as badges on the row: 50/day, $20/mo X, and Approval.

When a key hits a limit, the API returns 403. The messages say, for example, "API key "agent" reached its daily post limit (50/day). The limit resets at 00:00 UTC" and "X (Twitter) spend cap reached for API key ...". The daily limit counts every post that leaves draft through that key.

What can a key with guardrails not do? ​

Guardrails deny by default. A key with any guardrail set can only call the routes that are safe or that enforce its limits: creating, reading, editing, publishing, retrying, and archiving content; uploading and reading media; reading workspaces, connections, usage, and analytics; and using AI generation. Everything else returns 403.

Specifically:

  • It cannot create, edit, or delete API keys, so an agent cannot lift its own limits.
  • It cannot mint a reconnect link for an account.
  • With Require approval on, it cannot approve, reject, or publish a draft directly. It can only submit for approval.
  • It can only edit posts that it created, and only while they are still drafts.

How do approvals work with an agent key? ​

Turn on Require approval. The agent's posts appear as pending. An Editor, Admin, or Owner opens each one and clicks Approve & publish or Reject. See Drafts and approvals.

How do I use the key? ​

Pass it as a bearer token with the workspace ID. The Integrations page has snippets filled in for each surface.

bash
curl -H "Authorization: Bearer sk_YOUR_KEY" \
     -H "X-Workspace-Id: YOUR_WORKSPACE_ID" \
     https://api.socifyr.com/api/workspaces/YOUR_WORKSPACE_ID/connections

See Workspace header and the MCP setup.

Common problems ​

SymptomFix
No API Keys pageYour role cannot view keys. Ask an Owner or Admin.
"Create Key" is rejectedYou are at your plan's key limit. Revoke a key or upgrade.
Agent gets 403 "reached its daily post limit"Raise the limit on the key, or wait for 00:00 UTC.
Agent gets 403 "has guardrails and cannot manage API keys"Change keys from the dashboard.
Agent cannot publish a draftThe key requires approval. Have a teammate approve it.

Next steps ​