Skip to content

Manage access

A workspace holds your agents, and each member holds one role in it: viewer, editor, admin, or owner.

This document describes managing members and keys in the console. For what each role can do, see Workspaces and access.

Before you begin

  • You need the owner role to add a member or change a role, and admin to mint an API key.
  • Decide the role before you invite someone. Most people need editor; reserve owner for whoever administers the account.

Add a member

  1. Open Workspace · Members.
  2. Add the person by email address.
  3. Choose their role.

Roles apply to the whole workspace, so a member who can edit one agent can edit every agent in it. When someone should reach exactly one agent, give them their own workspace instead.

Change or remove a role

Open Workspace · Members, find the person, and change their role, or remove them from the workspace. Removing a member revokes their access immediately, including any console session already open.

A member's own API keys stop working at the role they held, so review keys after removing an admin.

Mint an API key

  1. Open Workspace · API Keys.
  2. Create a key and choose its scopes, the narrowest set that covers what the integration does.
  3. Copy the value when it is shown. Anychat stores only a hash and cannot show it again.
You want the key to Scopes
Read agents and their configuration agents:read
Edit Behavior and capability configuration, connect channels agents:write
Read conversations, logs, and activity messages:read
Read or manage People people:read or people:write
Send outreach from Adobe Journey Optimizer, and nothing else integrations:ajo

A write scope includes its read scope, so the console shows the read scope as included and stores only the broadest one.

To change a key's scopes later, choose Edit scopes on its row. The change takes effect immediately, and the key's value stays the same.

A key never exceeds the role of the member who minted it. An editor's key carrying an admin-only scope still gets 403 on an admin route, so mint keys for admin work from an admin account.

Rotate or revoke a key

Delete the key on Workspace · API Keys. Deletion takes effect immediately, so mint and deploy the replacement first when the key is in production use.

Rotate a key whenever someone who had access leaves, and whenever a key may have been exposed in a log, a screenshot, or a repository.

What's next