> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crakseo.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> For SEO data and indexing, start with /seo-mcp/overview.md and /seo-mcp/connect.md, then read the focused server reference.
> The documentation search MCP at https://docs.crakseo.com/mcp searches documentation only. Product tools use https://crakseo.com/mcp/<server>.
> Check tool availability and API credit balance before paid calls. Request owner approval for paid indexing. Never invent prices, indexing guarantees or directory approval.

# Authentication and scopes

> Bearer keys, project binding and what each scope unlocks.

> [!NOTE]
>
> Profile keys and the `browser`, `vault`, `data:*`, `connections:*` and `publish` scopes are available on legacy plans. New workspaces don't include agents or off-site posting; workspaces created before the CrakSEO launch keep them. Project keys with `seo:read`, `seo` and `indexing:*` work for everyone.

## Keys

* Send `Authorization: Bearer <token>`. Tokens are hashed for lookup, scoped, can expire and can be revoked. Existing token prefixes stay valid after rebrands.
* Requests must come from a trusted host; a mismatched `Origin` or `Host` is rejected. The app's own domain (crakseo.com) is trusted, and so are earlier domains that still point at it (such as frontpagelabs.co), so clients set up before the rename keep working.
* A key bound to a project cannot select a different project.
* A key connects to either a **project** or **one profile**. A profile key acts as that profile: it can chat with it, run its browsers and fleet, and use the tables the profile was granted, the same access as the profile's chat in the app.
* **Profile keys start with full access**: `seo`, `seo:read`, `publish`, `connections:*`, `indexing:*` and `vault`, plus `browser` (control of the profile) and whatever `data:*` scopes the profile itself has. Choose **Customize** when creating a key, or use the profile's **Permissions** page, to narrow it. Project keys start with read-only project data.
* The person who created a key can show and copy it again from **Settings → API keys** or the profile's **Connect** page; it is stored encrypted for that. Keys created before this was available show **Rotate to reveal**.
* **Rotate key** issues a new token; the old one stops working immediately while the connection, profile binding, grants and scopes stay the same.
* Browser-locked keys (created on a browser's **Connect an AI** tab) only operate that browser.

## Scopes

| Scope | Unlocks |
| - | - |
| Always | `get_capabilities`, `list_projects`, `get_project`, and safe project metadata |
| `browser` | Owner-authorized browser profiles and control, fleet and agent chat tools, workflow reads, Control Center proposals |
| `vault` | Explicit profile credential grants or managed-site credential references; never implied by `browser` |
| `data:read` | Discover and read granted data tables |
| `data:write` | Write granted rows with versions and idempotency keys |
| `connections:read` | Discover granted connections, connection tools and remote MCP tools |
| `connections:execute` | Execute granted connector and remote MCP tools |
| `seo:read` | The read-only keyword, campaign, competitor, SERP and managed-site tools. On by default for new keys ("Read project data") |
| `seo` | Everything in `seo:read` plus editing keywords, campaigns, competitors and records, and the mailbox and brand-launch tools ("Edit keywords and project data") |
| `publish` | Social publishing, scheduled tweets and podcast drafts |
| `indexing:read`, `indexing:submit` | Indexing account, quotes, submissions and job history |

Scopes are checked again on every call, so revoking a scope takes effect immediately. Table, connection and browser grants are enforced on top of scopes: a scope alone never grants access to a specific table, connection or profile.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.