Everything you can click, you can do programmatically

Most products treat an API key as a single, undifferentiated grant of power: you have the key, so you can do everything the account can do. That is convenient exactly until the key leaks, at which point it is the worst possible design.

Here, a key carries only the capabilities you attach to it. Reading agents is a separate permission from creating them, which is separate again from deleting them, and the same is true of training sources. A key that only needs to read cannot delete, no matter who ends up holding it.

This matters most for the keys you are least careful with. The one in your CI pipeline, the one in the internal dashboard somebody built in an afternoon, the one pasted into a shared environment file. Those keys should be able to do one narrow thing, and with scopes, they can be.

Every key can be given an expiry date when it is created. It is optional, and you should use it anyway.

The reason is simple. Credentials that never expire are the ones that quietly outlive the project they were created for, the employee who created them, and eventually your memory of what they were for. When you eventually find one, you cannot revoke it, because nobody knows what will break. An expiry date turns that from a decision you never make into a decision that gets made for you.

Key management is restricted to organisation owners, so this is not something a team member can route around.

The obvious case is scale. If you are an agency running agents for thirty clients, or a platform provisioning one per tenant, creating them by hand stops being viable quickly. The API makes agent creation part of your onboarding flow rather than a task on somebody’s list.

The less obvious case is keeping training data current. Retraining is a manual action in the dashboard, which is fine when your documentation changes monthly and painful when it changes daily. If your docs live in a repository, your existing pipeline can push sources through the API when they change, and the agent stays in step with the content without anybody remembering to make it happen.

API keys are the right tool when you are automating your own organisation. They are the wrong tool when you are building something other people will use against *their* AssistLoop accounts, because it would mean asking your users to paste a long-lived credential into your product.

For that, AssistLoop acts as an OAuth provider. Your app sends the user through an authorisation screen, they approve the access, and your app receives a token scoped to what they granted. They can see which apps they have connected and revoke any of them at any time, without touching a key or breaking anything else.

This is also the mechanism behind the tools you can connect from inside the dashboard. See the integrations page for what is available today, and agent actions if you want the agent itself calling your endpoints during a conversation rather than you calling ours.