API keys and permissions

Create a key so another tool can act in your workspace, and decide exactly what it is allowed to do.

Introduction

An API key lets something outside Custom One — your own code, an automation platform, or an AI assistant — read and change things in your workspace. It acts as you, within the permissions you give it.

An owner, an admin or a member can create and revoke keys. A guest cannot, and is shown who to ask instead.

How to create one

• Step 1: Open Integrations from the left menu.
• Step 2: Go to the tab that matches what the key is for — AI assistants or Automations. Both create keys; each starts you with a different set of permissions ticked. On AI assistants, the key form is folded under Using Cursor, VS Code or another tool configured by file?
• Step 3: Give the key a name you will recognise in six months.
• Step 4: Check the permissions, add or remove any, choose when it Expires (never, or in 30, 90 or 365 days), then click Generate key.

Warning — Copy the key straight away. It is shown once and never again. If you lose it, revoke it and make another.

Choosing permissions

The tab you started from ticks a sensible starting set — not a fixed one. Every permission is a separate tick, and the ones that cost money or cannot be undone are deliberately not bundled with the ones that cannot hurt. You cannot change a key’s permissions afterwards: you create a new key.

Permission	What it allows
Read the workspace (workspace:read)	See which workspace the key belongs to, and its tags.
Read customs (funnels:read)	List customs and read their questions, scores and scenes.
Build customs (funnels:write)	Create a custom and change its content. Everything stays a draft.
Publish customs (funnels:publish)	Take a draft live, where visitors can reach it.
Delete customs (funnels:delete)	Move a custom to the trash. Offered to owners and admins only.
Read leads (leads:read)	List the leads who came through, and their answers.
Add and update leads (leads:write)	Create leads and mark them purchased. Does not include making videos.
Generate result videos (leads:generate_video)	Render a lead’s personalised video. Each one is billed.
Manage webhooks (hooks:write)	Subscribe to events so an external tool is told when something happens.
Import contacts (sources:write)	Push contacts in from a CRM or a spreadsheet.

Give a key the least it needs. A key that can only read cannot damage anything, and you can always create a second one.

Test keys and live keys

The first letters of a key tell you which one you are holding. Every key you create in your workspace starts with co_live_ and works against your real workspace. co_test_ keys belong to Custom One’s development environment, not to your workspace.

Revoking a key

Revoke it from the same screen: Revoke, then Confirm?. It stops working immediately, and anything using it starts failing straight away — so replace it first if something depends on it.

A key created before permissions existed is marked as having full access. Replace those with a narrower key when you get the chance.