Profile keys and the
browser, vault, data:*, connections:* and publish scopes are available on legacy plans. New workspaces don’t include agents or off-site posting; workspaces created before the CrakSEO launch keep them. Project keys with seo:read, seo and indexing:* work for everyone.Keys
- Send
Authorization: Bearer <token>. Tokens are hashed for lookup, scoped, can expire and can be revoked. Existing token prefixes stay valid after rebrands. - Requests must come from a trusted host; a mismatched
OriginorHostis rejected. The app’s own domain (crakseo.com) is trusted, and so are earlier domains that still point at it (such as frontpagelabs.co), so clients set up before the rename keep working. - A key bound to a project cannot select a different project.
- A key connects to either a project or one profile. A profile key acts as that profile: it can chat with it, run its browsers and fleet, and use the tables the profile was granted, the same access as the profile’s chat in the app.
- Profile keys start with full access:
seo,seo:read,publish,connections:*,indexing:*andvault, plusbrowser(control of the profile) and whateverdata:*scopes the profile itself has. Choose Customize when creating a key, or use the profile’s Permissions page, to narrow it. Project keys start with read-only project data. - The person who created a key can show and copy it again from Settings → API keys or the profile’s Connect page; it is stored encrypted for that. Keys created before this was available show Rotate to reveal.
- Rotate key issues a new token; the old one stops working immediately while the connection, profile binding, grants and scopes stay the same.
- Browser-locked keys (created on a browser’s Connect an AI tab) only operate that browser.
Scopes
Scopes are checked again on every call, so revoking a scope takes effect immediately. Table, connection and browser grants are enforced on top of scopes: a scope alone never grants access to a specific table, connection or profile.