Sync and access
API keys and connected tools
Give a tool limited record access, choose its reach, and freeze, rotate or revoke a key when access changes.
A Glob Data API key lets a tool you choose read or change records within the permission you give it. It is separate from your Colli account password and your sync passphrase. Create a separate key for each tool so you can stop one connection without changing the others.
An access key also differs from an OpenAI or Anthropic provider key. A Glob key grants access to Glob records. A provider key pays for requests through your own account with that provider.
Choose what the tool can reach
A key has two parts to its permission: reach and the actions allowed within that reach. Together, these are its scope.
| Choice | What it allows |
|---|---|
| Account reach | Your account's private records. Shared-container records are excluded. |
| Container reach | Records within the selected container, including nested placements. |
| Read only | Reading a record and searching records inside that reach. |
| Read and write | Reading, creating and updating records inside that reach. |
Start with read-only access when a tool only needs to answer questions. For example, a research helper can read the notes in its scope without permission to edit them. Add creation and updates only for a tool you want to write records.
The supported permissions cover records. They do not grant record deletion, graph editing, link editing or account management. A key does not let the tool reset your password, manage other keys or sign in as you.
Access to a shared project also requires the key owner's membership and agreement to AI access from every member. A wider key scope cannot substitute for those permissions. This requirement is specific to connected-key access; do not treat it as a general switch for every AI feature in every app.
Create a key with the CLI
Use the CLI key guide for the supported creation flow. It works with an account sign-in and asks for a label, an agent nickname and the reach. Read-only is the default.
The label helps you recognise the key later. The agent nickname gives the connected tool its own name ending in -AI; it is separate from your personal Colli username.
Keys use a 30-day expiry by default. The CLI also lets you choose no automatic expiry. An expired key stops working even if it still appears in your list. Review expiry when a connection that used to work starts rejecting its key.
The Web and Mac creation forms do not provide the complete supported setup described here. Use the CLI guide when creating a new connection. You can use the Web panel below to manage existing keys.
Save a newly shown key
The complete key is shown once after creation or rotation. Copy and save it before dismissing the result. Listing keys later shows their details, not their secret values.
In the Web panel, the one-time result says Copy and I have saved it. If copying reports Could not reach the clipboard — select the key and copy it by hand., select the displayed value and copy it before closing the result.
Give the key only to the tool you intend to connect. You do not need to give that tool your account password or sync passphrase. Treat anything returned to the tool as information you have chosen to share with it; review that tool's own terms before connecting it.
Freeze, rotate or revoke a key
In Glob for Web or the Linux app, open Settings → Profile & account settings → API keys. Existing keys show a name and last used date, or never used. A frozen key is marked Frozen.
| Control | Use it when | Effect |
|---|---|---|
| Freeze | You want to pause a connection or suspect a problem. | Stops reads and writes through that key. |
| Unfreeze | You want the same connection to work again. | Re-enables that key, subject to its expiry and permissions. |
| Rotate | You need to replace the key's secret. | The old value stops working immediately; copy the new value and update the connected tool. |
| Revoke | The tool no longer needs access. | Permanently ends the key. The confirmation warns that it cannot be undone. |
Rotation keeps the same key identity and scope. Update every place using its old value, including the device answering the tool's requests. A running connection does not learn the replacement value automatically.
The CLI has account-wide freeze and unfreeze commands, described in its key guide. Account-wide unfreeze re-enables the existing non-revoked keys, including keys frozen individually; review them before using that action.
Why an authorised request can still fail
A key grants permission; a supported, online device still has to answer the request. The Web app's key panel does not turn the browser into that answering device. Follow the CLI guide for the device connection.
- No device available: bring the configured answering device online and start its connection.
- Timeout: the selected device did not return an answer. Check whether a requested write happened before repeating it.
- Scope denied: the requested action is outside the key's permissions. Check what the tool is trying to do.
- Frozen, expired or revoked key: use the key list to identify the state. Unfreeze a paused key or configure an appropriate replacement.
- Daily action allowance reached: wait for that key's allowance to reset. Retrying immediately does not add permission.
For a connection you do not recognise, freeze or revoke its key and contact [email protected]. See the Terms and Privacy Policy for connected-tool use and data handling.