What an API key cannot do
Account-level actions are reserved for browser sessions, and a key gets 403 with code
FORBIDDEN:
| Endpoint | Why |
|---|---|
GET, POST /api/user/api-keys and DELETE /api/user/api-keys/{keyId} | Keys cannot manage keys. |
POST /api/organizations | Creating a workspace needs a real interactive login. |
POST /api/organizations/{orgId}/invitations, DELETE .../invitations/{invitationId} | Membership changes. |
PATCH, DELETE /api/organizations/{orgId}/members/{userId} | Membership changes. |
POST /api/organizations/{orgId}/leave | Membership changes. |
POST /api/organizations/{orgId}/transfer-ownership | Ownership changes. |
PUT, DELETE /api/organizations/{orgId}/logo | Workspace profile. |
GET, PUT /api/user/profile, PUT /api/user/profile-image, POST /api/user/complete-onboarding | User profile. |
GET /api/auth/github/connect, /callback, POST /api/auth/github/disconnect | OAuth flows need a browser. |