An API key is meant for programs that can't sign in through a browser: a script that creates tasks every night, an automation that feeds support requests in from your own form, or a tool that updates wiki pages.
You create keys under AI assistants & API, in the API keys section. Every member can create their own keys there, whatever the subscription. What a key may do always depends on the permissions of the person it belongs to.
How API keys work in CIRO NOISE
When creating a key you give it a name, choose the organization it applies to and set its permissions. A key only works for that one organization and doesn't follow along when you switch organizations in the browser.
A key's permissions are the overlap between your own permissions and your selection. So you can only narrow it further, never extend it beyond what you may do. Ready-made selections help, such as Manage tasks only, Edit wiki only or Read-only.
For validity you choose 7 days, 30 days, 90 days, one year or no expiry. CIRO NOISE shows the key only once, right after you create it. Store it somewhere safe straight away, for example in the password vault.
Security and revoking
You can revoke a key at any time from the list, and the revocation takes effect immediately. The list also shows when each key was last used, so forgotten access is easy to spot.
If one of your permissions is removed, that applies to your keys immediately. If you leave the organization, CIRO NOISE revokes all your keys for it. If an organization is over capacity or scheduled for deletion, the keys of the members affected stop working as well.
API key or connected AI assistant
You don't need an API key for Claude, ChatGPT or Gemini. Those assistants connect through the Model Context Protocol (MCP), an open standard, using an address and a sign-in in the browser. Use an API key only for programs that can't do that sign-in.
An everyday example
A software company has a nightly script turn alerts from its monitoring into tasks. The team lead creates a key named Monitoring with the selection Manage tasks only and a validity of 90 days. The script can create tasks with it, but can't read invoices or customer records.