Permissions
| Permission | In the form | Allows |
|---|---|---|
account:read | Read profile, balance and usage | Your profile, plan, balance, credit history and usage; the list of plans and credit packs |
billing:write | Create payment links | Payment links for plans, credit packs and domains, for a person to open and pay |
ai | Call models | Chat, embeddings, images, speech, transcription, music, video and decision models |
agent:read | Read tasks | Agent tasks, their status, events and results |
agent:write | Run and cancel tasks | Start tasks, answer their questions and cancel them |
deploy:read | Read apps, databases and logs | Apps, deployments, build and runtime logs, usage, analytics, databases without passwords |
deploy:write | Ship, restart, change settings and domains | Upload and deploy, redeploy, restart, environment, an app’s custom domain |
deploy:admin | Delete apps and databases, see database passwords | Delete apps and databases, read database credentials, reset passwords |
files:read | Read files | Your uploads and the Library of files the agent made; handing files to a task |
files:write | Upload and delete files | Upload files and delete uploads and Library files |
automations:read | Read automations and runs | Automations, runs, versions, stats and data |
automations:run | Start runs | Start, cancel and retry runs, answer their questions and approvals |
automations:write | Create and change automations | Create, change, publish, activate and delete automations and their data |
projects:read | Read projects, their chats, files and notes | Projects as in the app |
projects:write | Create and change projects, members and files | Create, change and delete projects, members, invites, files and notes |
domains:read | Read domains and DNS records | Domains bought through Jobbit, availability and prices, DNS records |
domains:write | Change DNS, bind domains, payment links for domains | DNS records, pointing a domain at an app or at mail; buying and renewing also need billing:write |
webhooks:write | Manage webhooks | Create, read and delete webhooks, see their secrets and deliveries, rotate automation webhook secrets |
403 insufficient_scope, and the message names the missing permission.
Included permissions
A write permission includes its read, and admin includes write:| Permission | Also gives |
|---|---|
agent:write | agent:read |
deploy:write | deploy:read |
deploy:admin | deploy:write, deploy:read |
files:write | files:read |
automations:write, automations:run | automations:read |
projects:write | projects:read |
domains:write | domains:read |
GET /v1/key lists the key’s permissions with the included ones already added.
Access presets
| Preset | Permissions |
|---|---|
| Full access | All of the above |
| Read only | account:read, agent:read, deploy:read, files:read, automations:read, projects:read, domains:read |
| Custom | Only what you tick |
Limits
Limits narrow a key further. All of them are optional, and an empty limit means none.| Limit | Effect | Refusal |
|---|---|---|
| Credits per day | The key stops for the rest of the day once it has spent this much | 403 key_spend_limit |
| Credits per month | The same, until the month is over | 403 key_spend_limit |
| Expiry | The key stops working after this date | 401 invalid_key |
| Allowed IP addresses | Only these addresses and networks (IPv4 or IPv6, with CIDR) get through | 403 ip_not_allowed |
| Only these apps | Deploy and domain calls see and change only these apps; the key cannot create new apps | 403 app_not_allowed |
| Only these models | Model calls and model lists are limited to these models | 403 model_not_allowed |
| Only these agent workspaces | Agent tasks are created, listed and read only in these workspaces | 403 workspace_not_allowed |
Credit caps and workspace limits do not apply to automation runs yet. To cap an automation, set limits on the automation itself in Jobbit.
OAuth connections
Apps connected over MCP with OAuth get the permissions you approved on Jobbit’s consent page. When an app asks for nothing specific, it gets every permission exceptdeploy:admin and billing:write. Its key appears in your list and you can edit it like any other.