An API key lets something outside Automize act on your workspace without signing in as a person: another system, a script, or an AI assistant such as Claude. Each key does only what you tick when you create it.
Only a company admin can create or revoke keys. They are under Settings › Security › API keys.
1. Create a key
- Go to Settings › Security › API keys and find Create a key.
- Under What is this key for?, name it after who holds it, such as "Finance system" or "Thandi's assistant". You see this name in the list of keys and in the access review.
- Under Stop working on (optional), pick a date. A key with no date never expires. A date means a forgotten key turns itself off.
- Under What may it do?, tick only what the holder needs (see the next section).
- Click Create.
2. What a key may do
Reading — changes nothing
- See the list of processes: the name and description of every process in the workspace.
- Follow a run: whether a run is queued, working, finished or failed, and how long it took.
- See queued work: the backlog of work waiting for a robot.
- See the robots: which robots exist and whether they are online.
- Follow a queue item: what happened to one item of work in a queue.
Acting — causes real work to happen
- Start a process running: sets a process running on a robot. The process acts on your real systems (it may send mail, write to finance systems or move files) and a run cannot be taken back.
- Add work to a queue: puts new items into a queue for a robot to pick up. Anything added becomes real work.
A key with no permissions can sign in and do nothing.
3. Manage your keys
Live keys lists each key with its name, the first few characters (Starts with), what it May do, and when it was Last used. Click Revoke to stop a key working.
- Revoke any key you no longer use, and any key that may have leaked.
- A key marked "Everything on the external API — made before permissions existed" is an old key. Replace it with one that lists only what it needs.
- Give each system its own key, so you can revoke one without breaking the others.
4. Use a key from another system
Send the key on every request as a Bearer token:
Authorization: Bearer <your-key>
The Developers page in the menu has the API reference and examples. A key cannot reach settings, billing or other keys; those always need a person signed in as an admin.
5. Connect an AI assistant (MCP)
Automize has its own MCP server, so an AI assistant that supports the Model Context Protocol can work with your workspace. The assistant can:
- list your processes;
- start a process run, and check where a run has got to;
- add an item to a queue, check what happened to it, and get a link to upload a file for it.
To connect one:
- Create a key for the assistant, as above. Tick only what you want it to do. To let it look but not act, tick reading permissions only.
- In your assistant, add a remote MCP server with the address
https://[your Automize address]/api/v1/external/mcp. - Set the header
Authorization: Bearer <your-key>.
Things to know:
- The key must be one made with permissions. An old key with no permission list is refused, and so is a key limited to one connection or one queue.
- If the assistant tries something its key does not allow, it is told which permission is missing. Nothing happens.
- Starting a run or adding queue work is real. Check what your assistant plans to do before you let it.