Developers
API keys
An API key lets an AI app or a script act for your workspace. One key reaches every brand and design in that workspace, and nothing outside it.
Create a key
- Open Settings, then API keys. Workspace owners and admins can create and revoke keys; other members see the list read-only.
- Name the key after where it will live (for example "laptop, Claude Code"), pick its permissions and, if you want, an expiry date.
- Copy the key when it is shown. It is shown once; BrandPilot stores only a hash of it.
Permissions
| Permission | Scope name | What it allows |
|---|---|---|
| Read | READ | Brands, tokens, rules packs and kits, and the design handoff and prompt routes. |
| Send work back | ARTIFACTS_WRITE | Upload components, pages and assets as drafts for your review. Nothing is approved automatically. |
| Run paid steps | PIPELINE | Start steps that cost money, such as finishing an external design step. |
Give each key only what it needs. A coding agent that builds from your brand needs Read; add Send work back if it should upload designs for review.
Use a key
Send it as a Bearer token on every request. This call tells you which workspace and key you are using:
Check a key
curl https://brandpilot.dev/api/v1/me \
-H "Authorization: Bearer $BRANDPILOT_API_KEY"Keep the key in an environment variable such as BRANDPILOT_API_KEY, not in a file you commit. MCP setups for each app are in Connect your agent.
Revoke a key
Revoke a key from the same page; it stops working on the next request. A key also stops working when the person who created it leaves the workspace or is no longer an owner or admin.