Safe agent setup

A Space API key is a credential. These are the habits that keep it boring.

Keep the token out of files and history

Export it as an environment variable instead of pasting it into configs:

# ~/.zshrc / ~/.bashrc — or a .env file that is in .gitignore
export WAKATO_SPACE_KEY="wks_live_…"

Reference the variable everywhere:

{
  "mcpServers": {
    "wakato": {
      "type": "http",
      "url": "https://api.wakato.io/functions/v1/space-mcp",
      "headers": { "Authorization": "Bearer ${WAKATO_SPACE_KEY}" }
    }
  }
}

Least privilege, per agent

Mint one key per agent/tool, named after it ("Claude Code — marketing site", "Zapier — lead sync"), granting only the scopes that agent needs:

• Start with read + write. An agent can build pages, draft posts, and prepare everything without any run scope.
• Add run scopes one at a time when you actually want the agent going live (publishing, sending SMS/email, posting socially).
• Set an expiry for experiments; "no expiry" is for trusted, monitored integrations.

Per-agent keys make last_used_at meaningful and let you cut off one tool without disturbing the others.

CI and servers

• Store the token in the platform's secret manager (GitHub Actions Secrets, Vercel Environment Variables, etc.) — never in the repo, never in build logs.
• Scope CI keys tightly: a content-sync job needs tables:read, not the kitchen sink.
• Prefer short expiries for CI keys and rotate on a schedule.

- name: Sync content
  env:
    WAKATO_SPACE_KEY: ${{ secrets.WAKATO_SPACE_KEY }}
  run: ./scripts/sync.sh

Rotation & revocation

Tokens are shown once at mint time and stored hashed — nobody (including Wakato) can re-read one later.

1. Mint the replacement key with the same scopes.
2. Update the env var / secret where it's used.
3. Revoke the old key in Space → Settings → API Keys. Effect is immediate.

Rotate immediately if a token may have leaked (pasted in chat, committed, logged). Revocation is the kill switch: the next request with that key gets 401.

Blast-radius checklist

Worst case — a token leaks and you don't notice. What it can never do, regardless of scopes:

• Touch any other Space, your login, or member permissions
• Move money (wallet/finance are read-only)
• Read secret values (names only)
• Connect new social/OAuth accounts

What it can do is whatever you granted — which is why run scopes deserve a moment of thought, and why last_used_at is worth a glance now and then.