Team and API keys

Who can do what in your workspace, and API keys for the CLI, scripts and AI assistants.

View as Markdown

HeyCMO is an invitation-only, $0 operational Alpha for Stripe and Resend recovery emails. A person approves every message before it is sent. The guides also describe implementation capabilities outside the Alpha. Their presence here does not make them available in the pilot. Start with the Alpha checklist. Help: alpha@heycmo.ai.

Your teammates work in the same workspace through your organization. With HeyCMO's standard sign-in (Clerk), invite them from the organization switcher at the top of the dashboard: Manage → Members. On a HeyCMO deployment that signs people in through WorkOS AuthKit instead, the dashboard has no Members page: email alpha@heycmo.ai with your teammates' addresses and we invite them. Removing someone from the organization removes their access.

• Organization admins can do everything: connect accounts, change settings and caps, manage API keys, request go-live and turn the kill switch off. The person who created the workspace is one.
• Everyone else can read everything, approve or decline what is waiting, run loops and turn the kill switch on.

Your workspace id is on Settings → Team & API keys: quote it when you contact support or call the API.

API keys

Settings → Team & API keys → API keys lists every key with its scopes, expiry and last use — never the secret. Create key takes a label, the scopes it needs (read, approve, execute, admin — only ones you hold) and an optional expiry; the secret is shown once, with a copy button. Rotate issues a new secret with the same scopes and revokes the old one immediately (it gets 401 from the next request); for a no-downtime swap, create a second key, deploy it, then revoke the first. Revoke is immediate. You cannot revoke the last admin key of a workspace whose sign-in organization (Clerk, or WorkOS) has no active admin member — that would lock you out. Rotating the key the dashboard itself uses switches your session to the new secret.

CLI: heycmo keys list, heycmo keys create "GitHub Actions" --scopes read,execute --expires-in-days 90, heycmo keys rotate <id>, heycmo keys revoke <id> (--json on each). All of them need the admin key.

On your own machine you need no key. heycmo login opens your browser, you sign in as you do on the dashboard, and the CLI keeps a sign-in only you can read (~/.config/heycmo/credentials.json); heycmo logout forgets it. It can do what your role allows except approve: heycmo approve prints the link to the card, and you approve in the dashboard. A key in HEYCMO_API_KEY wins over the sign-in (CI, scripts).

Add HeyCMO to your AI tool. heycmo mcp install --client cursor (or vscode, windsurf, claude; --scope user for every project) writes HeyCMO's MCP address into that tool's settings, with no key in the file: the tool asks you to sign in the first time it connects. heycmo skill install adds the HeyCMO skill to Claude (.claude/skills/heycmo).