# Team and API keys

Who can do what in your workspace, and API keys for the CLI, scripts and AI assistants.

HeyCMO is an invitation-only, $0 operational Alpha for Stripe and Resend recovery emails. A person approves every message before it is sent. The guides also describe implementation capabilities outside the Alpha. Their presence here does not make them available in the pilot. [Start with the Alpha checklist](https://docs.heycmo.ai/getting-started/). Help: [alpha@heycmo.ai](mailto:alpha@heycmo.ai).

Your teammates work in the same workspace through your organization. With HeyCMO's standard sign-in (Clerk), invite them from the organization switcher at the top of the dashboard: **Manage** → **Members**. On a HeyCMO deployment that signs people in through WorkOS AuthKit instead, the dashboard has no Members page: email alpha@heycmo.ai with your teammates' addresses and we invite them. Removing someone from the organization removes their access.

- **Organization admins** can do everything: connect accounts, change settings and caps, manage API keys, request go-live and turn the kill switch off. The person who created the workspace is one.
- **Everyone else** can read everything, approve or decline what is waiting, run loops and turn the kill switch on.

Your workspace id is on Settings → **Team & API keys**: quote it when you contact support or call the API.

## API keys

Settings → **Team & API keys** → **API keys** lists every key with its scopes, expiry and last use — never the secret. **Create key** takes a label, the scopes it needs (`read`, `approve`, `execute`, `admin` — only ones you hold) and an optional expiry; the secret is shown **once**, with a copy button. **Rotate** issues a new secret with the same scopes and revokes the old one immediately (it gets `401` from the next request); for a no-downtime swap, create a second key, deploy it, then revoke the first. **Revoke** is immediate. You cannot revoke the last admin key of a workspace whose sign-in organization (Clerk, or WorkOS) has no active admin member — that would lock you out. Rotating the key the dashboard itself uses switches your session to the new secret.

CLI: `heycmo keys list`, `heycmo keys create "GitHub Actions" --scopes read,execute --expires-in-days 90`, `heycmo keys rotate <id>`, `heycmo keys revoke <id>` (`--json` on each). All of them need the admin key.

**On your own machine you need no key.** `heycmo login` opens your browser, you sign in as you do on the dashboard, and the CLI keeps a sign-in only you can read (`~/.config/heycmo/credentials.json`); `heycmo logout` forgets it. It can do what your role allows except approve: `heycmo approve` prints the link to the card, and you approve in the dashboard. A key in `HEYCMO_API_KEY` wins over the sign-in (CI, scripts).

**Add HeyCMO to your AI tool.** `heycmo mcp install --client cursor` (or `vscode`, `windsurf`, `claude`; `--scope user` for every project) writes HeyCMO's MCP address into that tool's settings, with no key in the file: the tool asks you to sign in the first time it connects. `heycmo skill install` adds the HeyCMO skill to Claude (`.claude/skills/heycmo`).