Keys and scopes

A self-hosted server always asks for an API key: Authorization: Bearer dk_… on every API call. The console asks for one once per browser session.

Each key has one scope, and each scope includes the ones before it:

Scope	Can
READ	see projects, runs, suites and results, and export them
WRITE	also import flows, generate grammars, start runs, dry-run on Connect
PUBLISH_LIVE	also run tests on Amazon Connect for real (billed) and remove them
ADMIN	also manage keys and the service’s administration screens

Create and revoke keys under Settings › API keys. The secret is shown once; only a hash is stored. The server will not let you revoke its last admin key.

What a key puts at stake is the Connect instance behind the server, since it can run billed tests there. Give PUBLISH_LIVE sparingly, and give automation a WRITE key.