API keys and permissions
Create a key so another tool can act in your workspace, and decide exactly what it is allowed to do.
Introduction
Section titled “Introduction”An API key lets something outside Custom One — your own code, an automation platform, or an AI assistant — read and change things in your workspace. It acts as you, within the permissions you give it.
An owner, an admin or a member can create and revoke keys. A guest cannot, and is shown who to ask instead.
How to create one
Section titled “How to create one”- Step 1: Open Integrations from the left menu.
- Step 2: Go to the tab that matches what the key is for — AI assistants or Automations. Both create keys; each starts you with a different set of permissions ticked. On AI assistants, the key form is folded under Using Cursor, VS Code or another tool configured by file?
- Step 3: Give the key a name you will recognise in six months.
- Step 4: Check the permissions, add or remove any, choose when it Expires (never, or in 30, 90 or 365 days), then click Generate key.
Warning — Copy the key straight away. It is shown once and never again. If you lose it, revoke it and make another.
Choosing permissions
Section titled “Choosing permissions”The tab you started from ticks a sensible starting set — not a fixed one. Every permission is a separate tick, and the ones that cost money or cannot be undone are deliberately not bundled with the ones that cannot hurt. You cannot change a key’s permissions afterwards: you create a new key.
| Permission | What it allows |
|---|---|
Read the workspace (workspace:read) |
See which workspace the key belongs to, and its tags. |
Read customs (funnels:read) |
List customs and read their questions, scores and scenes. |
Build customs (funnels:write) |
Create a custom and change its content. Everything stays a draft. |
Publish customs (funnels:publish) |
Take a draft live, where visitors can reach it. |
Delete customs (funnels:delete) |
Move a custom to the trash. Offered to owners and admins only. |
Read leads (leads:read) |
List the leads who came through, and their answers. |
Add and update leads (leads:write) |
Create leads and mark them purchased. Does not include making videos. |
Generate result videos (leads:generate_video) |
Render a lead’s personalised video. Each one is billed. |
Manage webhooks (hooks:write) |
Subscribe to events so an external tool is told when something happens. |
Import contacts (sources:write) |
Push contacts in from a CRM or a spreadsheet. |
Give a key the least it needs. A key that can only read cannot damage anything, and you can always create a second one.
Test keys and live keys
Section titled “Test keys and live keys”The first letters of a key tell you which one you are holding. Every key you
create in your workspace starts with co_live_ and works against your real
workspace. co_test_ keys belong to Custom One’s development environment, not
to your workspace.
Revoking a key
Section titled “Revoking a key”Revoke it from the same screen: Revoke, then Confirm?. It stops working immediately, and anything using it starts failing straight away — so replace it first if something depends on it.
A key created before permissions existed is marked as having full access. Replace those with a narrower key when you get the chance.