Authentication
Create and safely use scoped personal access tokens for the Omni Developer Preview.
Developer integrations authenticate with a scoped personal access token created at omni.channel/dev/keys.
Authorization: Bearer $OMNI_API_KEYCreate a token
- Sign in to Omni and open API Keys.
- Choose the Developer Preview profile.
- Give the token a name describing its environment or agent.
- Copy the secret when it appears. It is shown only once.
- Store it in a secret manager or local environment variable—not source control.
export OMNI_API_KEY="omni_sk_live_..."Recommended Preview scopes
| Scope | What it permits |
|---|---|
profile:read | Read the authenticated public identity |
workspace:read | Discover accessible workspaces |
chat:write | Create stateful tasks |
chat:read | Read tasks, events, and workspace history |
files:write | Reserve, upload, and complete encrypted files |
files:read | List files and storage quota |
files:delete | Delete files |
vault:write | Register uploaded knowledge with Vault |
vault:read | Read Vault state and attach ready files |
Missing permission returns 403 insufficient_scope. Resource authorization is still evaluated for every request; possessing a scope does not grant access to another user's workspace or file.
Revoke and rotate
Create a replacement token, update the consuming application, verify it, and then revoke the old token from /dev/keys. A revoked token returns 401 unauthorized.
Keep tokens secret
Treat a PAT like a password. Never put it in browser-delivered code, logs, screenshots, examples, or a Git repository.