Menu
Create, scope, restrict, and revoke keys·View as Markdown
API keys
Multiple keys per workspace. UI is only visible when your user/workspace is on the intelligence dogfood allowlist.
Create
Settings → API keys → Create. Choose a preset or custom scopes:
| Preset | Scopes |
|---|---|
| Read-only | workspaces/buckets/files/intelligence/automations/suggestions/shares/transfers read |
| Upload + read | files:read + files:upload + files:download (+ list scopes). Enough for presign, PUT, and complete_upload. Not tags/mkdir/move (files:write). |
| Agent read-only | buckets/files read + download + agent:run + automations/suggestions read |
| Full access | all scopes |
Optional: restrict to specific bucketIds, set expiry.
The secret is shown once. Store it securely; only keyPrefix is listed later.
Scopes
workspaces:read, buckets:read|write|delete, files:read|write|delete|upload|download, intelligence:read|write, agent:run, automations:read|write, suggestions:read|write, shares:read|write, transfers:read|write.
Keys cannot escalate past the creating member's workspace permissions.
Upload vs write
files:upload registers objects (presign_upload + complete_upload). files:write is tags, mkdir, and move. Do not grant write only to finish an upload. See Upload flow.
Use with MCP
{
"mcpServers": {
"file-rocks": {
"url": "https://www.file.rocks/api/mcp",
"headers": { "Authorization": "Bearer fr_live_..." }
}
}
}
Revoke
Settings → API keys → Revoke. Revoked keys fail immediately.