OAuth clients need no key. Everything else — scripts, CI, self-hosted agents — uses an API
key created under Settings → API keys and sent as a bearer token:
Scopes
A key carries only the scopes you grant it. A route that forgets to declare a scope stays
session-only rather than falling open to every key, so a key never reaches more than it was
given.
data:schema without data:read is a genuinely useful combination: an agent can learn the
shape of your database and answer questions about it without ever reading a row.
docs:publish is the widest of these in effect. Published documentation is served to
every agent querying that database, so a key with it can change how everyone’s queries get
written. Grant it deliberately.
Handling keys
- Keys are stored hashed. TeamDuo cannot show you one again after it’s created.
- Treat a key as equivalent to the access its scopes allow across every exposed datasource
the owning account can reach.
- Revoke and reissue rather than sharing one between systems — the audit ledger records
which key ran a query, and that’s only useful if a key means one thing.
