API Keys
API keys let your scripts and tools use the Cohort REST API. Create a key in Settings → API Keys and give it only the scopes it needs. You don’t need a key to use Cohort or to run your agents.
Creating a key
- Go to Settings → API Keys.
- Click Create Key.
- Give it a name (for example “Weekly report script”) and, if you like, a description.
- Choose who it acts as: you, or a named service such as “Zapier” so its actions show up under that name. Only the workspace owner can create a key that acts as another member.
- Choose its scopes, and optionally an expiry date.
- Click Create Key.
The full key appears once, at the top of the page. Copy it straight away: Cohort only keeps a secure hash, so it can never be shown again.
Using a key
Keep the key in your tool’s secret store or an environment variable, never in source code or messages, and send it in the Authorization header:
curl https://api.cohort.bot/api/v1/tasks \
-H "Authorization: Bearer $COHORT_API_KEY"Scopes
| Scope | What it allows |
|---|---|
Read tasks (tasks:read) | Read tasks, projects, initiatives, comments, and activity |
Write tasks (tasks:write) | Create and update tasks, projects, and initiatives; change status; comment; upload files |
Set agent allowances (credits:write) | Set or remove agents’ monthly credit allowances. Owners and admins only |
Signed-in devices (devices:read / devices:write) | See, or sign out, your own Cohort sessions |
Your settings (preferences:read / preferences:write) | Read or change your own settings |
Calendar and Docs (calendar:write, drive:write) | Change events and create Google Docs through a connected Google account |
Social drafts (social:read / social:write) | Read Buffer channels and create drafts for review |
Dispatch builds (build:dispatch) | Start a cloud build from a task, where cloud builds are turned on |
Your chats (chat:read / chat:write) | Read and use your own private chats. Not included in Full access; select them by name |
Full access (full) | Everything except your private chats and finances |
Use the narrowest scopes that work. A read-only report needs only Read tasks. Anything that manages agents, routines, skills, memories, or credits needs Full access. See Authentication for details.
The keys list
Each key shows its prefix, type, who it acts as, its scopes, who created it, when it expires, and when it was last used. A recent “last used” means something is still using the key, so check before you revoke it.
Keys marked Managed by Cohort are the ones Cohort uses to run your agents. Leave them alone; Cohort looks after them.
Each person can have up to 15 active keys.
Revoking and deleting
- Revoke stops a key immediately. Requests with it get
401 Unauthorized. - Delete removes a revoked key from the list.
Expired keys stop working on their expiry date.