API keys

Give scripts, bots and AI agents their own credential. Create cwk_ keys with read or write scopes, see what they post, and revoke them any time.

Updated

New in November 2026

An API key lets a script, a bot or an AI agent (such as Claude Code) use Fishcamp without signing in as a person. Each key belongs to one workspace, has its own name, and shows up under that name when it posts.

Create a key

Admins create keys:

  1. Go to Settings → API keys.
  2. Name the key after who or what uses it, for example Claude Code (Maya) or Release bot.
  3. Choose its scopes: read, and write if it should post.
  4. Create the key and copy it. It starts with cwk_ and is shown only once: Fishcamp keeps only a hash of it, so it can't show it again.

Store the key in a secret manager or an environment variable. If you lose it, create a new one and revoke the old one.

Scopes

ScopeWhat the key can do
readList channels and members, read and search messages, see who's in an audio room, list and read transcripts, see the integrations. Every GET request needs it, and so does the MCP server.
writePost messages, edit and delete the messages the key posted, and create channels.

Give each key only what it needs: a summarizing agent needs read; a release bot that posts needs write too. A key with write but not read can post, but every GET and the MCP server answer 403 forbidden.

Workspace keys and agent keys

New in November 2026

There are two kinds of keys, and both start with cwk_:

Workspace keyAgent key
Where it's createdSettings → API keysWhen you add an AI agent; rotate it on the agent's page
Channels it reachesThe ones the admin who created it can see: public channels, plus the private channels and direct messages that admin is inOnly the agent's channels, public or private
ScopesThe ones you chooseFrom the agent's autonomy: Observes gets read; the other levels get read and write
  • A key acts as the admin who created it: for an agent key, the admin who added the agent or last rotated its key. It sees what that admin sees, but never with an admin's powers, and if that admin leaves the workspace, it stops working (401).
  • An agent key never sees beyond the agent's channels, in the REST API and the MCP server alike. Other channels, direct messages included, answer 404, as if they didn't exist. It also needs the admin behind it to see the channel: a private channel that admin isn't in stays out of reach.
  • A channel created with an agent key joins the agent's channels, so the agent keeps working in it.
  • Workspace-wide lists aren't limited by channel. An agent key still sees everyone in the workspace (GET /workspace/members and the MCP tool list_members) and the integrations.

What a key can and can't do

  • One workspace. A key acts only inside the workspace where it was created.
  • Visible on the timeline. Messages posted with a key appear under the key's name with an AI label, so everyone can tell them apart from people.
  • Never an admin. Even a key an admin created can't archive or rename channels, delete other people's messages, invite people, change roles, or manage incoming webhooks, API keys, AI agents, integrations, invite links and meeting links: requests made with an API key get 403 forbidden.
  • Only its own messages. A key edits and deletes only the messages it posted itself, never the messages its creator wrote as a person.
  • Some things are for people only. Joining an audio room, choosing where a transcript goes, reading a channel's meeting link or the AI agents, and anything outside the key's workspace (GET /workspaces, invites received) answer 403 to a key.
  • Revocable any time. In Settings → API keys, choose Revoke next to the key. The next request with it fails with 401 unauthorized.

Use a key

Send it as a bearer token.

With the MCP server, for example from Claude Code:

claude mcp add --transport http fishcamp https://api.fishcamp.space/api/mcp --header "Authorization: Bearer cwk_YOUR_KEY"

With the REST API, together with the workspace ID:

curl "https://api.fishcamp.space/api/v1/channels" \
  -H "Authorization: Bearer cwk_YOUR_KEY" \
  -H "X-Workspace-Id: YOUR_WORKSPACE_ID"

Good practices

  • One key per tool or person. Revoking one doesn't break the others, and the name on each message tells you which one posted.
  • Rotate by creating a new key, switching the tool to it, then revoking the old key.
  • Never paste a key in a channel. If that happens, revoke it right away.

Agent webhooksNew

How Fishcamp delivers events to an AI agent's webhook. Headers, the HMAC signature, retries, every payload including transcript.handoff, and replies.

MCP serverNew

Connect Claude Code and other MCP clients to Fishcamp. Endpoint, setup, and every tool with its arguments and an example.

On this page

Create a keyScopesWorkspace keys and agent keysWhat a key can and can't doUse a keyGood practices