> ## Documentation Index > Fetch the complete documentation index at: https://docs.guild.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1. > The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml). > Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer :`. See https://docs.guild.ai/api-reference/introduction#authentication. > To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers. > To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt. # Create a dedicated API-key credential for a workspace agent > The key is stored under the workspace owner's account and used only by this agent. Callable by a user or by an account API key with integrations write scope; a key can only connect credentials to agents it installed itself, under its own account. With ``replace``, every live grant on the agent for the integration that serves every member is revoked in the same transaction, whoever made it. Under per-member resolution a member's grant of their own credential serves only them, so it stays. ## OpenAPI ````yaml /api-reference/openapi.yaml post /workspace_agents/{workspace_agent_id}/credentials/api-key openapi: 3.0.3 info: title: Guild Public API version: 1.0.0 description: >- The Guild public API, served at https://api.guild.ai/v1. Authenticate with an account API key, sent as HTTP Basic (key id as the username, secret as the password) or as a Bearer token `:`, or with an OAuth 2.0 access token. Each operation lists the credentials it accepts and the scopes it needs; see https://docs.guild.ai/api-reference/introduction#scopes. Versions are path integers and v1 is the only one: a breaking change ships as a new version rather than changing v1. Lists page with `limit` and `offset` and report `pagination.has_more`. A session-events websocket also exists at wss://api.guild.ai/v1/sessions/{session_id}/events/ws with the same credentials on the handshake; OpenAPI cannot describe websockets, so it is not listed in paths. servers: - url: https://api.guild.ai/v1 description: Production security: [] tags: - name: accounts - name: agents - name: integrations - name: other - name: sessions - name: skills - name: triggers - name: workspaces paths: /workspace_agents/{workspace_agent_id}/credentials/api-key: post: tags: - workspaces summary: Create a dedicated API-key credential for a workspace agent description: >- The key is stored under the workspace owner's account and used only by this agent. Callable by a user or by an account API key with integrations write scope; a key can only connect credentials to agents it installed itself, under its own account. With ``replace``, every live grant on the agent for the integration that serves every member is revoked in the same transaction, whoever made it. Under per-member resolution a member's grant of their own credential serves only them, so it stays. operationId: connect_workspace_agent_api_key parameters: - name: workspace_agent_id in: path required: true schema: type: string format: uuid - name: owner_id in: query required: true schema: title: Owner Id type: string - name: auth_config_id in: query required: true schema: format: uuid title: Auth Config Id type: string - name: event_id in: query required: false schema: default: null title: Event Id nullable: true type: string - name: replace in: query required: false schema: default: false description: >- Revoke the bindings that would block this one, in the same transaction: either everything commits or nothing changes. A dedicated key and a grant serving every member exclude each other. title: Replace type: boolean description: >- When `true`, revokes the existing bindings that would block this credential and creates the new one in the same transaction. Either everything commits or nothing changes, enabling atomic credential swaps. responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/CredentialAssociation' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - apiKey: [] - bearerApiKey: [] - oauth2: - integrations:write components: schemas: CredentialAssociation: type: object properties: id: type: string format: uuid created_at: type: string format: date-time updated_at: type: string format: date-time auth_config_id: type: string format: uuid description: Integration auth config this row applies to created_by_id: type: string format: uuid description: The user or API key that granted this credential to the agent. target_id: type: string format: uuid description: >- Workspace agent install receiving the credential; the association is scoped to this install's workspace. Account-wide availability is plain credential ownership with no association row. kind: type: string enum: - CONNECTED - GRANTED description: >- GRANTED = existing credential shared with the agent; CONNECTED = credential created for the agent (connect flow). credentials_id: type: string format: uuid nullable: true description: Linked credential row; null while OAuth connect is pending. integration: {} member_owned: {} owner: {} runs_as: {} workspace: {} workspace_agent_id: {} ErrorResponse: type: object properties: error: type: string message: type: string securitySchemes: apiKey: type: http scheme: basic description: >- API key: key id as the username, secret as the password. An account API key carries the same scopes as an OAuth token and is checked against the scopes listed under oauth2 on each operation. A trigger API key is limited to its trigger's workspace and reaches only the session operations that list this scheme alongside the oauth2 scopes. bearerApiKey: type: http scheme: bearer bearerFormat: : description: >- The same API key as one Bearer token, `:`. An account API key carries the same scopes as an OAuth token and is checked against the scopes listed under oauth2 on each operation. A trigger API key is limited to its trigger's workspace and reaches only the session operations that list this scheme alongside the oauth2 scopes. oauth2: type: oauth2 description: >- OAuth 2.0 authorization code flow with PKCE (S256). Discovery: https://api.guild.ai/.well-known/oauth-authorization-server. flows: authorizationCode: authorizationUrl: https://api.guild.ai/v1/oauth/authorize tokenUrl: https://api.guild.ai/v1/oauth/token refreshUrl: https://api.guild.ai/v1/oauth/token scopes: agents:read: Read agents agents:write: Read and change agents sessions:read: Read sessions sessions:write: Read and change sessions workspaces:read: Read workspaces workspaces:write: Read and change workspaces skills:read: Read skills skills:write: Read and change skills integrations:read: Read integrations integrations:write: Read and change integrations applications:read: Read applications applications:write: Read and change applications organizations:read: Read organizations organizations:write: Read and change organizations ````