Agent Keys
Issue, scope, and revoke the bearer tokens that let agents and integrations drive your workspace.
Agent keys are bearer tokens Borker issues so agents and scripts can act in your workspace. They're separate from the API keys you bring (your Anthropic or Paragraph credentials under Settings → API Keys) — an agent key never exposes those.
Manage them at Settings → Agent Keys. Only workspace admins and owners can create or revoke keys; every member can see the list.
Token format
bork_live_a1b2c3d4_NRSXG43NN5XGKZBAMFXG2LBAMVWGS5DHNRSXG4
└─┬─┘└─┬─┘└──┬───┘ └──────────────┬───────────────────┘
app env prefix secret (shown once)livetokens work on production;testtokens on non-production environments. They are never interchangeable.- The 8-character prefix is safe to log and is how a key appears in the Settings list.
- The secret is stored only as a keyed hash. Nobody — including Borker — can recover it after the one-time reveal.
Scopes
Scopes are hierarchical: each level includes everything below it.
| Scope | Grants |
|---|---|
| Read | List and inspect: channels, brand, schedule, stats, content |
| Write | Read + create drafts, generate posts, approve/edit/reject, schedule, delete |
| Admin | Write + manage other agent keys, see creator emails and the brand industry block |
Pick the smallest scope that does the job. A content agent needs Write; a reporting dashboard needs Read; almost nothing needs Admin.
Who acts, and how it shows up
Every key remembers who created it. Content created with the key is attributed to that person in the Pipeline, marked with an API source badge, and the key's role in the workspace still applies — a key created by an editor can't do admin-only things regardless of its scopes. If the key's creator leaves the workspace, the key stops working.
Revoking
Click Revoke next to a key. The next request with that token gets
a 401 invalid_api_key — there is no grace period. Revoked keys stay
listed for 30 days for reference. There's no "edit" for keys: to
change scopes, revoke and issue a fresh one.
Treat a token like a password. If it may have leaked — pasted into a chat, committed to a repo, shared in a screenshot — revoke it immediately and issue a new one. Rotation costs seconds.
Issuing via API
Keys can also manage keys (useful for rotation), guarded by admin
scope and admin/owner role. A token cannot revoke itself in the same
request. See the reference for
POST /api/v1/keys and DELETE /api/v1/keys/:id.