Explicit access, resource by resource.
Each key combines account identity, validity, and scopes. You control reach without sharing your password.
Bearer token
Send the secret in the Authorization header in all REST and MCP calls.
bash
Authorization: Bearer ach_live_...Server-only calls
Don't expose a key in public JavaScript, distributed applications, or extensions without an intermediate backend.
Available scopes
Read and write scopes are independent. Grant only what is necessary for each integration.
account:readConsult this resourceoffers:readConsult this resourceoffers:writeChange this resourcepublications:writeChange this resourcegroups:readConsult this resourcegroups:writeChange this resourcesegments:readConsult this resourcesegments:writeChange this resourcecoupons:readConsult this resourcecoupons:writeChange this resourcecommissions:readConsult this resourcepublications:readConsult this resourcetemplates:readConsult this resourcetemplates:writeChange this resourceschedules:readConsult this resourceschedules:writeChange this resourcemonitors:readConsult this resourcemonitors:writeChange this resourcestore:readConsult this resourcestore:writeChange this resourcejourneys:readConsult this resourcejourneys:writeChange this resourceinbox:readConsult this resourceinbox:writeChange this resourceanalytics:readConsult this resourcelinks:writeChange this resourcewebhooks:readConsult this resourcewebhooks:writeChange this resourceKey lifecycle
1
Created
The secret is revealed once.
2
Activates
Usage and responses appear in the audit.
3
Expired or revoked
Access stops immediately without affecting other keys.
Good practices
One key per environment.
Short validity for tests and temporary agents.
Semiannual rotation for permanent integrations.
Immediate revocation when a secret is exposed.