Account MCP

The Account MCP is the account-level sibling of the Space API. Where a Space key (wks_live_…) locks an agent inside one Space, an Account API key (wka_live_…) lets an agent operate your account itself: create and manage Spaces, allocate wallet budget, buy phone numbers, enable gateway models, invite members — and mint Space keys to hand off the in-space work.

It's a focused, auditable control plane — small enough to review everything a key can do in one sitting (the complete, always-current list lives under MCP Tools → Account Tools). For contacts, tables, pages, automations and the rest of the in-space catalog, agents bridge into the Space API — see Delegation below.

1. Mint a key

In Wakato: Backstage → API Keys → New account key.

• Scopes default to read-only. Every write is an explicit opt-in.
• Spend limits: granting wallet or phone write access requires a monthly spend limit (USD, rolling 30 days). Without one, spend actions are blocked even when scoped. An optional per-action limit caps any single purchase or allocation.
• Space access controls which Spaces the key may manage:
  • All my spaces — every Space you own (never Spaces you're only a member of).
  • Only spaces it creates — a sandbox: the agent can build freely without touching anything that existed before it.
  • Selected spaces — an explicit allowlist, plus anything it creates.

Copy the wka_live_… token — it's shown once.

2. Connect over MCP

claude mcp add --transport http wakato-account \
  https://api.wakato.io/functions/v1/account-mcp \
  --header "Authorization: Bearer wka_live_YOUR_TOKEN"

Or in a committed config (keep the token in an environment variable):

{
  "mcpServers": {
    "wakato-account": {
      "type": "http",
      "url": "https://api.wakato.io/functions/v1/account-mcp",
      "headers": { "Authorization": "Bearer ${WAKATO_ACCOUNT_KEY}" }
    }
  }
}

As with Space keys, tools/list is scope-filtered: tools the key lacks scopes for are not listed at all. If an agent says it "can't" do something, check the key's scopes first.

What an agent can do

Account keys can also carry space_tools — a passthrough that calls in-space tools (contacts, tables, pages, mail…) directly, space_-prefixed and containment-checked against the key's allowed Spaces.

So a single conversation can be: "Set up a Space for the new client, fund it with $20, enable Claude Sonnet, buy a local 415 number for it, and invite sam@client.com."

The delegation pattern

For in-space work, the agent mints itself a Space key and connects to the Space API — account-mcp stays the small, auditable control plane:

1. create_space — a new Space, owned by you.
2. allocate_space_funds — new Spaces start at $0; give it a budget.
3. enable_space_model — put models on the Space's gateway.
4. create_space_api_key — mint a scoped wks_live_… key for that Space.
5. Connect to /functions/v1/space-mcp with the new key and build: contacts, tables, pages, automations, apps, mail — the full in-space catalog.

Built to be safe

Every write the key makes is recorded to an audit ledger (tool, target, amount, arguments) you can review, and per-key rate limits apply. Revoke the key in Backstage → API Keys and everything stops instantly — including any Space keys you choose to revoke alongside it.

Safety recap

• Account keys act only on Spaces you own — never Spaces you merely joined.
• Money moves only inside the key's monthly spend limit; no limit set = no spending, even with the scope granted.
• spaces.write cannot delete a Space; members.write cannot remove the owner.
• The token is hashed at rest and shown once; rotate by revoking and minting a new key.