Skip to main content
Goal: Give a tool limited access to your organization’s Provider workspace, the dashboard area for its application and model routes. You are done when: you have stored the secret securely and checked its permissions and expiry. Creating a key does not submit a feed or approve a route.

​
Check your invitation first

Machine access is by invitation and must be enabled separately for your organization. These instructions describe the key controls; they do not mean machine access has been enabled for your organization. If Machine access is not enabled for this organization appears, continue in the browser and contact Millwork about an invitation. Existing keys can still be reviewed and revoked while access is off. An owner or admin must create and manage these keys in their browser session. A normal organization API key cannot replace a provider machine key.
1

Open Machine keys

In Provider workspace, open Machine keys and refresh the list. Choose Create machine key when machine access is enabled.
2

Choose permissions and expiry

Add a useful label. Select only the permissions the tool needs:Choose 1 day, 7 days, or 30 days. Expiry is required; a key cannot renew itself. These permissions do not allow customer runs, domain proof, profile changes, webhook setup, or creating another key. Withdrawal and other protected changes need their own browser approval.
3

Save the secret once

Choose Create key, then store the secret in your approved secret store before closing the reveal. The key ID and prefix identify the key; they are not the secret. The secret cannot be retrieved later.For invited online CLI access, configure MILLWORK_PROVIDER_API_KEY privately and MILLWORK_PROVIDER_API_URL with the API origin including /v1. Do not put the secret in command arguments, feed files, source code, chat or logs. A shell-capable agent can read its own environment, so use only the bounded key you intend that tool to hold.

​
Recover an uncertain creation

If the first response or secret is lost, do not repeat the creation request. Refresh the list, identify any new key by its label, ID and prefix, and revoke every new key whose secret you did not save. Then explicitly create a replacement. A repeated successful request can return idempotent_replay_secret_unavailable; it cannot recover the old secret.

​
Revoke or replace a key

Open Machine keys, choose Revoke for that key, check its identity and confirm. Revocation takes effect on its next request and cannot be undone. When replacing a key, update the tool’s secret store and revoke the old key. An expired or revoked key must be replaced; enabling machine access again does not renew it.