Initializing Operalta...

Operalta

API Keys

Generate and manage keys for programmatic access

Audience
Developer
Truth
Mixed sources
Surface
API
Status
Active

Related documentation: Developer documentation

Create, scope, and rotate keys for the API, CLI, and MCP.

API keys managed securely in Operalta

How it fits

How a key grants programmatic access

A key identifies a caller, carries only the scopes it needs, and remains bounded by the person and company behind it.

  1. Create

    Key

    Generate a personal or company-bound credential for a defined environment.

    • Personal
    • Company
    • CI
    Open Key
  2. limits
    Limit

    Scopes

    Choose the smallest set of read, write, or integration actions required.

    • Context
    • Reports
    • Rooms
    Open Scopes
  3. authenticates
    Call

    Tool or API

    Use the key from HTTP, the CLI, or a local MCP server.

    • Bearer
    • CLI
    • MCP
    Open Tool or API
  4. stays inside
    Enforce

    Company boundary

    Real membership and server-side policy still cap what the key can reach.

    • Role
    • Company
    • Audit
    Open Company boundary

Create

  • Personal Settings → Developer → API Keys for personal or network-scoped CLI/MCP work.
  • Company Settings → Developer → API Keys for company-bound automation.
  • Copy immediately — the key is shown once.
  • Use a separate key per environment (laptop, CI, production).

Use

  • Authorization: Bearer op_... for HTTP.
  • OPERALTA_API_KEY for the CLI and MCP server.

Scopes

  • Prefer explicit scopes: context:read, metrics.actuals:read, contacts:write, connect:write, artifacts:write, rooms:read, reports:read, lists:read, integrations:write, reports.send:manage.
  • No-company personal keys are limited to scopes that do not require company authority; network workflows should pass OPERALTA_NETWORK_ID or --network-id where supported.
  • Legacy read / write / admin still work but are coarser.
  • A key is always capped by your real role; use bundles per integration.
  • Company-bound key usage is logged in the company audit trail.