Using BetterContext Copy

API Keys & Authentication

Generate, scope, rotate, and manage API keys for personal developer environments and automated CI/CD service accounts.

BetterContext API keys grant access to your organization's memory graphs and tools. All requests must be authenticated using valid secret tokens.

Token Types

Personal Access Tokens (PAT)

Tied to individual team members. Perfect for local IDEs, CLI development, and personal agents. Inherits the user's specific RBAC permissions.

Service Account Tokens

Independent of individual employees. Ideal for CI/CD runners, scheduled cron automations, and production server-to-server microservices.

Permission Scopes

To enforce the principle of least privilege, limit token capabilities to required scopes:

Scope	Access Level	Typical Use Case
`context:read`	Read-only	Read-only agent querying in Cursor, Claude Desktop, and IDEs.
`memory:write`	Read & Write	Ingestion scripts, document upload bots, and CI changelog upserters.
`graph:manage`	Administrative	Pruning stale nodes, overriding edge half-lives, and managing ACLs.
`workspace:admin`	Full Control	Inviting teammates, managing billing, and rotating workspace keys.

Generating Keys via CLI

Developers can generate scoped tokens directly from the terminal:

# Generate a read-only agent key expiring in 90 days
bettercontext auth create-key \
  --name "cursor-developer-mac" \
  --scope "context:read" \
  --expires-in 90d

Key Rotation & Revocation

If an API key is ever exposed or an employee departs:

Navigate to Settings > API Keys in the Web Console.
Click Revoke next to the compromised key. Revocation is propagated globally in under 2 seconds.
Generate a replacement token and update your environment secrets.

Next Steps

Was this page helpful?

ON THIS PAGE

Overview
Token Types
Permission Scopes
Generating Keys
Rotation & Revocation
Next Steps