BerryBox API keys and agent access
Give each tool only the access it needs, for the time it needs it.
Create a key in Settings → API keys. Each key belongs to a team and a creator account. Its scopes, expiry, revocation status and the creator's current membership and role are checked by the server.
New keys expire after 24 hours by default, with a maximum lifetime of 30 days. A delegated key cannot outlive its source key or grant scopes its caller lacks.
Pick scopes
| Scope | Purpose |
|---|---|
teams:read | Read team identity |
ci:read | Read jobs, logs, runners and CI summaries |
billing:read | Read wallet, holds, costs and budget, subject to role |
ci:write | Change runner settings or disconnect GitHub, subject to role |
billing:write | Create payment handoffs and change billing settings, subject to role |
members:read, members:write | Read or manage membership |
keys:read, keys:write | Read key metadata or manage keys |
teams:write, audit:read | Edit team details or read audit events |
Start an agent with teams:read and ci:read. Add financial visibility only when needed. Scope names are explicit; there is no wildcard that an agent should request by default.
Store and revoke
A newly created secret is shown once. Enter it through the hidden CLI login prompt. Do not paste it into chat, put it in command arguments or commit it in a repository.
berrybox logout removes the local credentials file. It does not revoke copies elsewhere. Revoke the key in the dashboard to stop all copies. Rotation creates a new generation; update your local credentials deliberately.
For CLI key creation or rotation, save the returned secret using --output-token FILE. Secret-returning operations are excluded from MCP.
Limits still apply
A short-lived key limits API authority. It does not bypass team roles, API rate limits, prepaid credit, runtime reservations or job concurrency. Removing a team member also removes their ability to use keys that depend on that membership.