Skip to main content

​
API keys

Create keys under API keys in the dashboard. Owners and admins can issue and revoke keys. Copy a new key when it is shown and store it in a server-side environment variable or secret store. Send it as a Bearer token:
Keys belong to one workspace. Scopes control actions; resource selection limits which inboxes and phone numbers those actions can use. Start with read-only access and add write scopes when needed. Keep keys out of browser code, source control, and logs. Use a separate key for each integration so you can revoke access independently. To change a key’s scopes, resource selection, or daily limits, create a replacement and revoke the old key.

​
OAuth

MCP clients and the CLI can open a browser consent flow. Sign in, choose a workspace, review the requested scopes, and select resource access. An OAuth connection stays bound to that workspace when you switch workspaces in the dashboard. Manage or revoke it under Integrations. To change its resource selection, revoke it and connect again. REST tokens use the https://www.papers.bot/v1 audience. Remote MCP tokens use https://www.papers.bot/mcp; they are not interchangeable. Access also depends on current membership and the issuing login session.

​
Inspect access

GET /v1/me returns the current identity, scopes, resource grants, sendLimits, and provisioningLimits. These are snapshots, not reservations. Another request can consume capacity before your next action. GET /v1/capabilities reports configured service availability. It does not grant permissions or guarantee provider health. See permissions for the scope list.