> For the complete documentation index, see [llms.txt](https://help.usejimo.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.usejimo.com/docs/integrations/mcp/api-keys-for-automations.md).

# API keys for automations

A Slack bot, or an AI agent your team hosts cannot sign in through a browser. For those, create an API key: keys let a server-side agent use the Jimo MCP without a browser login.

A key is a service account owned by the project, not by the person who created it. It keeps working if that person leaves, ensuring continuity for your automations.

{% hint style="warning" %}
This is **not** the Jimo REST API (Settings → Integrations → API). Those credentials do not work here, and an MCP key does not work there.
{% endhint %}

## Create a Key

{% stepper %}
{% step %}
**Open the API Keys card**

Go to [Settings → Integrations → Model Context Protocol](https://i.usejimo.com/settings/integrations/mcp) and click **+ New key**.
{% endstep %}

{% step %}
**Name it after the job**

One key per automation, so a single job can be revoked alone. The field suggests "Release Automation".
{% endstep %}

{% step %}
**Choose what the key can do**

Under **What this key can do**, tick the permissions the job needs: **Read project data and analytics**, **Manage Experiences**, **Teach my Jimo Agent**, **Build and run my Jimo Agent**. They work exactly like the [assistant permissions](/docs/integrations/mcp/permissions-and-safety.md).

<figure><img src="https://2794860263-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKzAcDWQbK1gKbpra7bkb%2Fuploads%2FTYNF3qwWZssuGIGWC5ZP%2Fimage.png?alt=media&amp;token=eadd253d-35db-4e9e-951c-999e7b7cd47e" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Set Custom Access**

Under **Custom Access**, choose what the key may reach, independent of who created it: view experiences and their analytics, create and edit experiences, publish and pause experiences, view posts and post analytics, create and edit posts, publish posts, view end users' identities.

The experience tools use the same boxes, there is no separate one for them:

| What the key does                                               | Box to tick                                                                                     |
| --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| Display rules, audience, theme and position, tags, translations | **Create and edit experiences** (**Create and edit posts** for posts)                           |
| A/B tests, publish, pause and resume                            | **Publish and pause experiences** (**Publish posts** for posts)                                 |
| Delete something live                                           | **Delete experiences** or **Delete posts**. Not ticked by default: tick it under Custom Access. |

The **AI Agent** group covers the agent:

* View the agent setup and conversations
* Edit pages, skills and settings
* Delete pages and skills
* Manage AI knowledge

Ticking **Build and run my Jimo Agent** grants view and edit. **Delete pages and skills** stays unticked until someone opts in, the same as deleting experiences or posts. A read-only key can view the agent setup and its knowledge, it cannot change them.

<figure><img src="https://2794860263-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKzAcDWQbK1gKbpra7bkb%2Fuploads%2FEXTmBGT10TK9M5SINApB%2Fimage.png?alt=media&amp;token=408dd907-df9c-47c7-af63-6c6098a3f6fd" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Copy the Client ID and Client secret**

The secret is shown once. Store it in your secret manager right away.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
Custom Access applies to keys only. An assistant that signs in through the browser works with your own Jimo role.
{% endhint %}

## How a Key Works

Your script exchanges the Client ID and Client secret for a short-lived access token (about 30 minutes), then calls the same endpoint an assistant uses:

```
https://mcp.usejimo.com/mcp
```

Good to know:

* Content created by a key has **no author**, and webhooks it triggers carry no user.
* The same [preview and confirm rules](/docs/integrations/mcp/permissions-and-safety.md#every-change-is-previewed-first) apply to keys as to assistants.
* A key cannot create or end an A/B test: those need a signed-in Jimo user. Run them from an assistant connected with your account.
* Up to **10 keys per project**.

## Rotation and Revocation

| Action          | Effect                                                                                                                                                     |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Rotate**      | Issues a new secret. The previous one keeps working for 24 hours, or until you click **Retire previous secret**, so you can swap secrets without downtime. |
| **Revoke**      | Disables the key and every token minted from it immediately.                                                                                               |
| **Permissions** | Fixed at creation. To change them, revoke and create a new key.                                                                                            |

{% hint style="info" %}
A key created before October 7, 2026 cannot gain **Build and run my Jimo Agent**: create a new one.
{% endhint %}

{% hint style="danger" %}
Never share a Client secret, including with Jimo support.
{% endhint %}

## Next Steps

* [Managing Access, Usage & Limits](/docs/integrations/mcp/managing-access-usage-and-limits.md): where keys are listed, rotated, and revoked.
* [Tools Reference](/docs/integrations/mcp/tools-reference.md): what a key can call, depending on its permissions.