API keys & permissions

Your account, your project

Each personal key belongs to a management user and one project. The key follows that user's current permissions and assigned creators. Owners can view key metadata and revoke project access, but cannot retrieve someone else's secret.

Removing a membership permanently removes its keys and project grants. Rejoining does not revive old credentials. Revoked or expired keys fail immediately. Tutorials are available to all management members.

Permission checks

Operations check project membership, the required action permission, record ownership, and creator assignments. Field-specific changes retain dashboard permission rules. Plan limits also apply. Tracked-video allowances do not stop scraping.

Project-wide charts, crossposting, errors, bulk ledger generation, project refreshes, and creator membership management additionally require creators.view_all. Assigned-only managers can use filtered creator/account/post/payment datasets and per-creator operations.

Integration credentials are write-only. Responses expose configuration status without returning saved secrets. Creator recovery codes and device tokens are never included.