---
title: "API keys and permissions"
description: "Create a key, choose what it may do, and revoke it."
slug: "en/integrations/api-keys"
url: "https://docs.custom.one/en/integrations/api-keys/"
capability: "integrations"
published_at: "2026-10-26T04:39:20.657Z"
---
Create a key so another tool can act in your workspace, and decide exactly what
it is allowed to do.

## Introduction

An **API key** lets something outside Custom One — your own code, an automation
platform, or an AI assistant — read and change things in your workspace. It acts
as you, within the permissions you give it.

An **owner**, an **admin** or a **member** can create and revoke keys. A
**guest** cannot, and is shown who to ask instead.

## How to create one

- **Step 1:** Open **Integrations** from the left menu.
- **Step 2:** Go to the tab that matches what the key is for — **AI assistants**
  or **Automations**. Both create keys; each starts you with a different set of
  permissions ticked. On **AI assistants**, the key form is folded under *Using
  Cursor, VS Code or another tool configured by file?*
- **Step 3:** Give the key a name you will recognise in six months.
- **Step 4:** Check the permissions, add or remove any, choose when it
  **Expires** (never, or in 30, 90 or 365 days), then click **Generate key**.

> **Warning —** Copy the key straight away. It is shown once and never again. If
> you lose it, revoke it and make another.

## Choosing permissions

The tab you started from ticks a sensible starting set — not a fixed one. Every
permission is a separate tick, and the ones that cost money or cannot be undone
are deliberately not bundled with the ones that cannot hurt. You cannot change a
key's permissions afterwards: you create a new key.

| Permission | What it allows |
|---|---|
| Read the workspace (`workspace:read`) | See which workspace the key belongs to, and its tags. |
| Read customs (`funnels:read`) | List customs and read their questions, scores and scenes. |
| Build customs (`funnels:write`) | Create a custom and change its content. Everything stays a draft. |
| Publish customs (`funnels:publish`) | Take a draft live, where visitors can reach it. |
| Delete customs (`funnels:delete`) | Move a custom to the trash. Offered to owners and admins only. |
| Read leads (`leads:read`) | List the leads who came through, and their answers. |
| Add and update leads (`leads:write`) | Create leads and mark them purchased. Does not include making videos. |
| Generate result videos (`leads:generate_video`) | Render a lead's personalised video. Each one is billed. |
| Manage webhooks (`hooks:write`) | Subscribe to events so an external tool is told when something happens. |
| Import contacts (`sources:write`) | Push contacts in from a CRM or a spreadsheet. |

Give a key the least it needs. A key that can only read cannot damage anything,
and you can always create a second one.

## Test keys and live keys

The first letters of a key tell you which one you are holding. Every key you
create in your workspace starts with `co_live_` and works against your real
workspace. `co_test_` keys belong to Custom One's development environment, not
to your workspace.

## Revoking a key

Revoke it from the same screen: **Revoke**, then **Confirm?**. It stops working
immediately, and anything using it starts failing straight away — so replace it
first if something depends on it.

A key created before permissions existed is marked as having full access.
Replace those with a narrower key when you get the chance.