API keys, scopes, acting on behalf of users, and key rotation.
Create keys under Settings → API keys. Keys are shown once. Send them as a bearer token:
curl https://api.brewmycode.com/v1/knowledge-bases \
-H "Authorization: Bearer bmc_live_…"
Test keys (bmc_test_…) run agents in test mode (writes simulated) and are safe for development.
Each key has scopes. Grant the minimum:
| Scope | Allows |
|---|---|
knowledge:read | List knowledge bases, documents; run queries |
knowledge:write | Create/delete knowledge bases, sources, documents |
agents:read | List agents and runs; read traces |
agents:run | Trigger runs; answer approvals |
agents:write | Create and promote agent versions |
webhooks:manage | Manage webhook endpoints |
admin | Users, roles, audit log, billing |
Queries are permission-filtered for a user. Pass the workspace user's email in as_user; the key must belong to an admin or have the impersonate flag. Without as_user, the key's own grants apply (typically a service identity with explicit knowledge base grants).
{ "knowledge_base": "ops-eu", "query": "…", "as_user": "marja@example.com" }
Create a new key, deploy it, then revoke the old one. Revocation is immediate. All key actions are recorded in the audit log.
Enterprise workspaces can restrict API access to CIDR ranges under Settings → Security.
If you are building an app that other workspaces install, use the OAuth 2.0 authorization code flow. Contact us for a client registration.