{"query":"API Keys and Delegated Access","corpusVersion":"local","generatedAt":"2026-11-03T06:47:56.417Z","results":[{"blockId":"admin-console.api-keys#api-keys-and-delegated-access","pageId":"admin-console.api-keys","title":"API Keys and Delegated Access","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#api-keys-and-delegated-access","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"api-keys-and-delegated-access","kind":"reference","productArea":"admin_console","score":4049.1214293464504,"reasons":["search_match","exact_match","title_match","term_match"],"markdown":"# API Keys and Delegated Access"},{"blockId":"admin-console.api-keys#delegated-developer-access","pageId":"admin-console.api-keys","title":"Delegated developer access","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#delegated-developer-access","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"delegated-developer-access","kind":"reference","productArea":"admin_console","score":3305.438262013888,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Delegated developer access\n\nExternal Agents benchmark operations can also use delegated native login with explicit read/write scopes and current project read/manage permission. That user principal is different from an API-key principal.\n\nBrowser cookie authentication remains the interactive app path. Do not substitute a browser cookie for a server credential or assume a delegated token is accepted on every API route."},{"blockId":"admin-console.api-keys#definition","pageId":"admin-console.api-keys","title":"Definition","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#definition","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"definition","kind":"reference","productArea":"admin_console","score":2498.084468892885,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Definition\n\nUse **Admin → API Keys** to manage workspace-owned credentials. A credential's base capability, optional restrictions and the destination's current permissions determine what a request can do."},{"blockId":"public-api.authentication#api-keys","pageId":"public-api.authentication","title":"API keys","pageTitle":"API Authentication","url":"https://teammately.ai/docs/public-api/authentication.md","humanUrl":"https://teammately.ai/docs/public-api/authentication#api-keys","markdownUrl":"https://teammately.ai/docs/public-api/authentication.md","sectionId":"api-keys","kind":"api","productArea":"public_api","score":2135.2253322196552,"reasons":["search_match","exact_match","api_intent_match","term_match"],"markdown":"## API keys\n\nKeys belong to a workspace. Base capability can be read-only, full access or Fieldloop submission. Project restrictions, allowed actions and expiry narrow that capability when supplied.\n\nA new Fieldloop submission key carries that workspace capability. The caller still supplies the Project and source destination, and current access is checked at intake. Previously issued restricted keys retain their restrictions.\n\nChanging access requires issuing the intended credential; renaming a key does not broaden it. Never place values in URLs, source, logs or copied agent tasks."},{"blockId":"admin-console.api-keys#related-task-pages","pageId":"admin-console.api-keys","title":"Related task pages","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#related-task-pages","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"related-task-pages","kind":"reference","productArea":"admin_console","score":1838.240884577052,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Related task pages\n\n{% related-card-grid title=\"Related task pages\" %}\n- [Capture and Inspect Logs](/docs/fieldloop/ingest-logs)\n- [Work with External Agents](/docs/improve/external-agents)\n- [Permissions](/docs/reference/permissions)\n- [Admin Console](/docs/admin-console)\n{% /related-card-grid %}"},{"blockId":"admin-console.api-keys#scope-and-safe-handling","pageId":"admin-console.api-keys","title":"Scope and safe handling","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#scope-and-safe-handling","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"scope-and-safe-handling","kind":"reference","productArea":"admin_console","score":1713.496836569533,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Scope and safe handling\n\nUse an explicit organization, Project, Benchmark and Version for the operation. Keep the key out of copied agent tasks, source files, Case materials and logs. A stable resource ID is not an authorization grant.\n\nThe supported external contract defines endpoint schemas and required capability. An internal route or a visible key-management screen does not establish an unrestricted customer API."},{"blockId":"admin-console.api-keys#fields-states-or-lifecycle-rules","pageId":"admin-console.api-keys","title":"Fields, states, or lifecycle rules","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#fields-states-or-lifecycle-rules","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"fields-states-or-lifecycle-rules","kind":"reference","productArea":"admin_console","score":1632.2943645284533,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Fields, states, or lifecycle rules\n\n- The UI offers Full Access, Read Only and Fieldloop Submission.\n- The full key value is shown at creation; later lists use a masked value.\n- Renaming a key does not broaden its access.\n- Changing access requires issuing the intended credential.\n- Deleting a key removes its future credential path.\n- Expiry and project/action restrictions, when supplied, narrow the base capability."},{"blockId":"admin-console.api-keys#fieldloop-submission","pageId":"admin-console.api-keys","title":"Fieldloop Submission","pageTitle":"API Keys and Delegated Access","url":"https://teammately.ai/docs/admin-console/api-keys.md","humanUrl":"https://teammately.ai/docs/admin-console/api-keys#fieldloop-submission","markdownUrl":"https://teammately.ai/docs/admin-console/api-keys.md","sectionId":"fieldloop-submission","kind":"reference","productArea":"admin_console","score":1627.0810186987107,"reasons":["search_match","exact_match","page_title_match","term_match"],"markdown":"## Fieldloop Submission\n\nA new Fieldloop key has the workspace-wide Fieldloop submission capability. Its application sender still specifies the intended Project and source. Current workspace, destination and source authority are rechecked by the backend.\n\nFuture sources in the same workspace do not require copying the key into every source policy. Existing keys issued with narrower Project or source restrictions keep those restrictions.\n\nSupply the key through the application's approved secret mechanism. This ingestion path does not require CLI login, browser authentication or expanded login grants."}]}