Keys and permissions
The API key BladeCP MCP uses, the scope each tool needs, keys tied to one migration, expiration and the rate limit.
The server uses your API key only to call the BladeCP API for you. The scopes of the key decide what the account tools can see.
Scopes by tool
| Tools | Scope |
|---|---|
get_account | customer:read |
list_servers, get_server, get_server_usage, list_server_domains | provisions:read |
list_migrations, get_migration, list_migration_destinations | migrations:read |
list_doc_pages, get_doc_page, search_docs | None, they work without a key |
All three scopes are included in personal keys. The server never needs migrations:write: leave it out of a key that an agent only uses to read.
get_account shows the scopes of the key in use. A tool called without the scope it needs answers 403 with the code insufficient_scope.
Which key to use
- A personal key for your own account, created in API keys in the Hub.
- A key created by the BladeCP WordPress Migrator only sees its own migration. Anything else answers
403withKEY_BOUND_TO_MIGRATION. - The key saved by
bladecp loginserves the BladeCP CLI on that computer. The server does not read it and still needsBLADECP_API_KEY.
Expiration and rotation
Personal keys expire, after 90 days by default. When the account tools start answering 401, with the code api_key_expired once the key reached its expiration date, create a new key in the Hub, update the variable and start a new agent session. Revoke the keys you no longer use.
Rate limit
Each key can make 60 requests per minute, shared by everything that uses it. On 429 with the code rate_limited, the agent waits and asks again.
Next step
Security: what the agent can and cannot do.