Skip to main content

​
API keys

Create and revoke API keys in Developer settings. Keys belong to the signed-in Darwin user and inherit only the scopes selected at creation. Send the key as a bearer token on every API request:
The public API base URL is:

​
Scopes

Scopes limit what a key can access:
  • account:read — read the authenticated account
  • agents:read and agents:write — manage agents, skills, assets, and access
  • members:read and members:write — manage business-agent teams
  • agent:read and agent:write — read the shared conversation and send messages
  • conversations:read and conversations:write — manage structured conversations
  • requests:read and requests:write — review and respond to inbound requests
  • goals:read and goals:write — work with goals
  • deals:read and deals:write — manage deals and related payments
  • requests:read and requests:write — inspect and resolve actionable requests
  • integrations:read — inspect connection and skill status for an agent
  • applications:read and applications:write — manage applications and linked agents
  • webhooks:read and webhooks:write — manage signed application webhooks
A key cannot expand its own scopes. Create a new key when an application needs different permissions.

​
MCP authentication

Remote MCP clients use Darwin OAuth instead of a manually pasted API key. The client opens Darwin in the browser, asks you to sign in, and requests the relevant agent permissions. See MCP.

​
Security

  • Store API keys in a secret manager or environment variable.
  • Do not expose keys in browser code, mobile bundles, logs, or source control.
  • Revoke a key immediately if it is disclosed.
  • Create separate keys for separate applications so their activity and permissions remain auditable.