What permissions should a key have?
Give each key the fewest permissions that let it do its job. If it leaks, it can do less harm.
| Job | Permissions |
|---|---|
| Start Cosmos Agent runs from a backend | runs:write, runs:read |
| Show run progress and balance on a dashboard | runs:read, account:read |
| Chat app using SuperCosmos | models:invoke |
| CI job uploading to Code Buckets | buckets:read, buckets:write |
| Nightly backup job | buckets:read, backups:write |
Avoid Full access for anything that runs unattended.
Good to know#
- Never put a key in front-end code, a mobile app, a public repo or a screenshot.
- Give each integration its own key with only the permissions it needs.
- If a key may have leaked, revoke it first, then replace it.
Learn more#
Still need help?#
- General support: support@clatterlabs.com or team@clatterlabs.xyz
- Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz
We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Related articles
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.