API keys

An API key is a credential for your workspace, for a script, an automation or a server. It belongs to the workspace rather than to a person, so it keeps working when someone leaves.

Open Developer tools in the sidebar, then the API tab. Only admins can create, rotate and revoke keys. Members see the page read-only.

Create a key

Choose Create key and name it. Full access is selected by default, including scopes for capabilities that are not active yet. Choose a narrower preset or adjust the scopes before creating the key.

Open Advanced to tick scopes one by one. The meaning of each scope is on the Authentication page.

For an SDK key that only asks assistants questions, use Ask questions and limit it to the assistants your product needs.

You can also:

• Set an expiry: 30, 90 or 365 days, or none.
• Limit the key to some assistants. A key limited this way can only use those, and cannot create new ones.

A key looks like sk_live_.... Lookio shows it once, then stores only a hash. If you lose it, revoke it and create another. A workspace can hold up to 10 active keys.

Rotate and revoke

• Rotate creates a new key and stops the old one right away. Copy the new key, then update whatever used the old one.
• Revoke stops a key at once. It cannot be undone.
• Rename changes the label only. The key does not change.

Personal connections

When someone signs in from the CLI or connects an AI client, Lookio creates a connection tied to that person. The Connections section lists each one with who approved it, what it may do and when it was last used. An admin can revoke any connection. A revoked connection loses access immediately, and its owner can connect again.

A connection acts with its owner’s permissions. See Members and permissions.

Connection tokens are valid for 30 days and renew with a refresh token that lasts 90 days, which the CLI handles for you.

API keys or connections