API keys and scopes
Make a key, pick its scopes and set a monthly credit cap
A key is a bearer token for one workspace. It starts with smr_, lasts 90 days and acts as the person who created it, with only the scopes ticked when it was made. Send it in the Authorization header:
curl -s https://app.makesmores.com/api/v1/credits \
-H "Authorization: Bearer $SMORE_API_KEY"
MCP clients should connect with OAuth instead of a pasted key. See MCP.
Create a key
- Open API keys in the console and select Create key.
- Name it after the person or machine that will use it, for example
ci-runner. - Pick a preset or tick scopes in the grid. Each product area shows how many of its scopes you ticked.
- Optionally set a Monthly credit cap.
- Copy the key. S'more shows it once. After that the console shows only its last four characters.
You can revoke a key at any time from the same page, and calls with it stop at once. A key that expires stops working the same way; make a new one.
Presets
| Preset | Scopes it ticks |
|---|---|
| Models and data | reddit:posts:read, reddit:posts:write, reddit:signals:read, reddit:signals:write, x:signals:read, viral:score |
| Reddit mentions | reddit:signals:read, reddit:signals:write |
| Scans | scans:read, scans:write |
| Everything I can grant | Every scope your role allows |
A preset never ticks a scope your role cannot grant. A member who picks Models and data gets its read scopes and viral:score; drafts and profile proposals need a key from an owner or admin.
Scopes by product area
S'more has 46 scopes. The console's key form shows these 39, grouped by product area:
| Area | Scopes | What they reach |
|---|---|---|
| Agents and leads | agents:read, agents:write, runs:start, runs:read, runs:cancel, leads:read, leads:write | Lead agents: create and run agents, read their leads and pick draft versions |
| Company research | research:read, research:write, research:approve, prospecting:read, prospecting:write, prospecting:start, prospecting:policy:write | Company research: plan research, find and qualify companies, read results and files |
| X signals and posting | x:signals:read, x:signals:write, x:post:send, viral:score | X signals, Viral Score, and posting X posts you approve |
| X outreach | outreach:read, outreach:send, outreach:cancel, x:activity:read, x:inbox:read, x:automation:write | Outreach from a connected X account |
| LinkedIn outreach | linkedin:outreach:read, linkedin:outreach:send, linkedin:outreach:cancel | Approved invites, messages and comments from a connected LinkedIn account |
| LinkedIn tracking | linkedin:activity:read, linkedin:inbox:read, linkedin:automation:write | Invites followed to acceptance, replies and stats |
| Writers and Reddit posts | reddit:outreach:read, reddit:outreach:send, reddit:outreach:cancel, reddit:posts:read, reddit:posts:write | Every writer model through drafts, and approved Reddit comments, posts and chats |
| Reddit mentions and signals | reddit:signals:read, reddit:signals:write | Mentions, signals and content briefs, top posts |
| Security scans | scans:read, scans:write | Repository scans |
Drafts for every writer model use the reddit:posts scopes, labelled "Read drafts" and "Write drafts for review". smore_get_credits needs no scope: any key can read its workspace's credits. The Security scans area shows only in workspaces where scans are open.
The other seven are not on the key form:
| Scopes | Why |
|---|---|
facebook:activity:read, facebook:inbox:read, facebook:automation:write, facebook:outreach:send, facebook:outreach:cancel | Facebook groups have no API or MCP tools yet. The app uses these scopes for its own watching |
evaluations:read, evaluations:write | Held only by sign-ins S'more's operators approve. A key cannot hold them |
Two more scopes arrive with products that are not live yet: decisions:run for Decisions and web:read for Web search.
A call with a key that lacks the route's scope answers 403 insufficient_scope before any work starts, and costs nothing.
Who can grant what
| Role | Can put on a key |
|---|---|
| Member | Scopes ending in :read, plus viral:score. A member an owner has given rights on a connected X account can also hold outreach:send, outreach:cancel and x:automation:write |
| Owner or admin | Every scope on the key form, including writes such as reddit:posts:write, reddit:signals:write and scans:write |
A member who asks for a write scope gets 403 admin_required. Every member can still read: list mentions, read signals and score posts.
Monthly credit caps
A cap stops one key from spending more than a set number of credits in a UTC month. S'more counts the key's charges minus its refunds since the start of the month, including jobs still running. A call that would go over answers 402 credits_required with reason: "key_cap".
- Owners and admins can set, raise or clear the cap on any key.
- A member can change only their own keys, and can only lower a cap or set one where none exists.
- A key a member creates gets a cap of 10,000 credits unless they ask for less.
- The console's test key has a cap of 1,000 credits.
A cap is a whole number of credits from 1 to 1,000,000,000. GET /api/v1/credits shows the calling key's month-to-date spend, its cap and what is left.
Keep keys safe
- Keep keys in environment variables or a secret manager. Never commit them or paste them into a chat.
- Make one key per person or machine, so you can revoke one without breaking the others.
- Give each key only the scopes its job needs.
- If a key leaks, revoke it in the console and make a new one.