AI client lifecycle and API keys
The AI clients page contains connection URLs for interactive OAuth clients
and API keys for advanced or headless clients.
Prefer OAuth
Use OAuth when the client supports it. OAuth keeps the user and workspace
selection visible during authorization and avoids copying a long-lived secret.
After connecting:
- Confirm the selected Stackyapper workspace.
- Ask the client to list or inspect available tools.
- Run one bounded read.
- Confirm the call and client name in Audit.
API keys
Create an API client only when the software cannot complete the supported OAuth
flow.
The full key is displayed once. Copy it directly into the intended client's
secret store. Do not put it in chat, tickets, source control, screenshots, or
shared notes.
Revoke or rotate
Revoke a client when:
- A device is lost or reassigned.
- A key may have been copied to the wrong system.
- A user or automation no longer needs access.
- The client name or ownership cannot be established.
For rotation, create and verify the replacement first, update the intended
client, then revoke the old key. Confirm in Audit that new calls use the
replacement client.
Wrong workspace
If a client is connected to the wrong workspace:
- Revoke or disconnect the client.
- Select the intended workspace in Stackyapper.
- Start authorization again.
- Read the consent screen before approving it.
- Run a harmless read and verify its workspace in Audit.