Agent keys

What a key is

A key is a named agent with its own credential. It connects Claude Code, Codex, or a script to BLOM: through BLOM's MCP server, and through the CLI and the public API.

A key belongs to the person who makes it. You're its accountable owner, the person it answers to, and BLOM records its work under its name, with yours beside it:

Claude · Ada Lovelace

A key never has more access than you have, and if your own access narrows, so does the key's. If you stop being an active member of the organization, BLOM suspends your keys' agents and refuses their keys.

Any member makes keys of their own, and API keys lists yours. Every agent in the organization, with the person it answers to, is listed under Agents on People and access.

Make a key

1. Open Create key

   In the rail, open Organization, then API keys, and select Create key.

2. Name it

   Name is the only field you must fill, such as Claude, Claude Code on Ada's laptop, or CI. BLOM records the key's work under this name, so one key for each agent keeps their work apart. The name need only be unique among your own keys.

3. Choose its access

   Under Access, the key gets Read and write where you may give it, unless you choose Read only or Admin. The table below says what each allows.

4. Choose where it reaches

   Under Where, choose Whole organization, the default, or Chosen products, up to 29 of them. A key for chosen products reads the whole organization, so its exports carry the process and standards its tasks run under, but changes only those products.

5. Choose when it expires

   Under Expires, choose 30 days, 90 days, the default, 1 year, or Never. A key that never expires works until you revoke or roll it.

6. Create it

   Select Create key. BLOM makes the key's agent, gives it the access you chose, and issues the key, in one step.

What each access allows

No key issues keys or credentials, grants roles or delegations, invites people, connects repositories, or changes settings. People do those in BLOM.

The key, shown once

BLOM shows the new key in a dialog named for it, such as Claude's key:

• Address: your organization's own MCP address, with Copy the address.
• Key: the key itself, with Copy the key, and when it expires.
• Connect your agent: the prompt to paste into Claude Code, Codex, or another agent, and the steps after it. Connect Codex or Claude Code walks through them.
• Do it by hand: the commands to connect a client yourself.
• A link to the key's page.

Every key starts with blom_agent_, followed by 43 random letters, digits, hyphens, and underscores.

BLOM won't show the key again. When you've stored it where your terminal asks, select I've stored it. Before the dialog closes, BLOM asks you to confirm, since it can't show the key again.

Your keys

API keys lists your keys by name. Each row shows:

Access

Read only, Read and write, or Admin.

Where

Whole organization, or its products by name.

Last used

When it last reached BLOM, or Never.

Expires

Its date, Never, or that it expired or was revoked.

Select a key's name to open its page. Roll key and Revoke end the row.

Roll a key

Roll a key to replace it, such as when it's lost or has expired. Select Roll key, choose when the new key expires, and select Roll key again.

BLOM makes a new key for the same name, with the access and reach it has now, and ends the current key at once: anything using it stops working until you give it the new one. The new key shows once, with the same prompt. Paste that prompt into your agent to give it the new key.

Revoke a key

Select Revoke, give a reason if you like, and select Revoke key. The key stops working at once, for anything using it. Its name is free to use again, and its work stays in the history.

Revoking ends every credential the key's agent holds, and deactivates the agent, ending its roles. To connect again, make a new key, which can take the same name.

The key's page

A key's page is its agent's page, headed with the agent's status and its Agent ID. It shows:

About

What it runs on, its provider, its accountable owner, when it was registered, and Its queue: what waits on the agent.

Delegation

Where it may act, each scope with Read or Read and change.

Role grants

Its roles, each at the organization, a team, or a product.

What it may reach now

The least of its roles, its delegation, and its accountable owner's own access, scope by scope.

Credentials

Each credential, with when it was issued, when it expires, when it was last used, and its status.

History

Each change to the agent, such as to its roles, its delegation, its credentials, or its accountable owner, with who made it, when, and why.

Only an Administrator or the agent's accountable owner sees its role grants, what it may reach, and its credentials. An Administrator can also deactivate an agent: every credential it holds is revoked and its role grants end, and its record and history are kept.

What the record shows

Everything a key's agent does is recorded as the agent's work, never as yours. BLOM shows the agent with you beside it, as the person it answers to, wherever its work appears, such as on a task's notes, a closure, or a standard's draft:

Claude · Ada Lovelace Codex · Grace Hopper

Each change the agent makes through the MCP server also answers with a receipt naming the agent, its accountable owner, and the channel it came through. Rolling or revoking a key never removes its work from the history.

Related