Scopes & keys

Keys and Connect grants are limited by scopes. Request only what your integration needs.

Manage keys in the app

Open app.aepto.com/api-keys (avatar menu → API Keys / MCP).
Create a key, select scopes, and store the aep_live_ secret in your secrets manager.
Rotate by creating a new key, updating clients, then revoking the old key.

Typical scope areas

Exact scope strings are listed in the app when you create a key and in OpenAPI. Expect separate read/write style access for domains, monitors, Domain Watch, Theft Guard, AI discovery, and account metadata. MCP tools enforce the same underlying permissions as the v1 handlers they call.

Connect grants

Users see authorized apps on Connected apps and can Disconnect anytime. Chrome, WordPress, and Claude do not ask users to paste API keys.

FAQ

Where do I create and rotate keys?

app.aepto.com/api-keys (avatar menu → API Keys / MCP). Create a new key, update clients, then revoke the old one.

Where are exact scope strings listed?

In the app when you create a key, and in the OpenAPI file. Expect separate read/write style access for domains, monitors, Domain Watch, Theft Guard, AI, and account metadata.

Do MCP tools use different permissions?

No. MCP tools enforce the same underlying scopes as the Platform API handlers they call.

How do users revoke a Connect app?

Avatar menu → Connected apps → Disconnect.