Integration permissions and API-key ownership

My own jobs is deployed for Slack and the hosted MCP server. GPT/ChatGPT and Claude client integrations remain untested and undeployed.

Integration access comes from Coworkies account authority, the selected hiring account and credential scopes. Slack membership, installation and employer contact details do not establish ownership.

Who can do what?

Person or credential	Connect and manage space jobs	Create space API keys
Verified individual hiring manager	Personal jobs only: the same creator and no attached space. No Pro requirement.	Use account connection; no self-service personal API key.
Coworkies space owner	Yes, for their eligible space and granted scopes. MCP private access additionally needs exactly one eligible confirmed Pro space.	Yes, for a confirmed Pro space they manage.
Coworkies Team Member with `staff` role	Same space job authority as the owner, including jobs created by other Team Members.	Yes, for a confirmed Pro space they manage.
Ordinary coworking space member	No automatic management or publishing rights.	No space-management key authority from membership alone.
Slack member, administrator or app installer	Installation/membership grants no Coworkies authority. Each publisher connects separately.	No authority from their Slack role.
Holder of a valid ordinary space key	Can exercise the key owner’s permissions. Native Slack key entry does not separately authenticate the holder’s Coworkies login.	Holding a key alone does not grant the website account’s key-management rights.
Platform administrator or approved importer	Separate, explicitly controlled server privileges; normal connectors do not confer them.	Platform administration follows separate rules.

Account-based connection requires an active, verified account. Personal hiring needs no space. Space hiring additionally requires a current owner/Team Member relationship to a confirmed space. Being employed by the company does not itself create the staff relationship in Coworkies.

Access differs by integration

Route	Space selection and access
REST ordinary space key	Space-bound operations follow the key’s space, scopes and owner’s current authority.
Slack account connection	Choose My own jobs or an eligible confirmed managed space. No Pro requirement; one hiring account per Slack member/workspace.
Slack native API-key connection	The key selects the space and delegates its owner’s authority. Read/write job permissions are required.
MCP OAuth discovery	Active, verified account with the discovery scope.
MCP OAuth private jobs	My own jobs with explicit job scopes, or exactly one eligible confirmed Pro space with owner/Team Member authority. Consent selects the hiring account.
MCP direct API key	Public discovery only, even when the key can write through REST.
GPT plugin / Claude connector	Not yet tested or deployed. No verified client access is promised.

Who can create, view, rotate and revoke keys?

A space owner or Team Member can create a key for a confirmed Pro space they currently manage. Ordinary non-space keys cannot manage jobs.
The account limit is 10 active, unexpired keys, including assistant credentials.
The complete ordinary key is shown only when created or rotated. Space managers can view key metadata, not recover its secret.
Only the key creator can rotate it. Rotation revokes the previous secret; update clients immediately.
The key creator or a platform administrator can revoke it. Being the space owner does not automatically let you revoke another Team Member’s personal key.
Only a platform administrator can issue admin scope. A key prefix or integration name never establishes authority.

Pro is enforced on the server when creating or rotating an ordinary self-service API key. The key must belong to a confirmed Pro space you manage; non-space self-service creation is refused. Platform administrator issuance is separate. Internal personal/space Slack credentials and personal/space/discovery MCP grants use dedicated server-controlled routes and do not require a manual Pro API key. Existing keys are not automatically revoked; their expiry, scopes and current-role checks still apply. A denied rotation preserves the original key.

Use Create and manage API keys for the UI steps. Use GET /v2/auth/key to inspect a key’s effective scopes and space through the authenticated REST API.

Scope does not replace ownership

jobs:read and jobs:write, or their supported parent scopes, control REST job operations. Space membership and current account/key validity are checked as well. spaces:write and offers:write require explicit scopes; broad write does not include them. MCP currently disables space/offer writes regardless of a REST key’s scopes.

A personal connection can manage only rows whose creator is the connected Coworkies user and which have no attached space. It cannot access a space job, even if the same user created it. A space manager can manage the connected space’s jobs, not another space’s. Legacy keys with a null space gain no personal access; only explicit account consent creates that grant. A job’s contact email does not confer ownership. Keys should be dedicated to one purpose and publisher; sharing a manager’s key deliberately delegates that manager’s authority.

Shared personal limits

Personal hiring requests use one database-backed allowance per user: 20 per minute and 1,000 per UTC day, across both MCP and Slack, including identity validation. Key rotation, reconnecting and multiple workspaces do not add quota. Unavailable quota storage returns 503; revocation remains available. MCP discovery limits and paid publication credits are separate.

Permission to submit is not guaranteed publication

Server-side job plans, hiring allowance and checkout rules determine whether a job becomes active or stays a draft/payment-required result. A paid submission without available coverage may remain a draft. Read the actual response and complete payment on Coworkies; no integration promises free or unlimited publication. See Space plans.

What happens when access changes?

Change	Effect
Key expires or is revoked; account disabled	Subsequent authorized operations fail. OAuth refresh is also blocked when its credential/account is invalid.
Key owner loses management role	Private space operations stop.
Space loses Pro	Space-scoped private MCP access stops; this alone does not revoke ordinary REST or Slack authority. Publication rules still apply.
Slack account connection is disconnected	Its separately issued credential is queued for revocation; colleagues and published jobs are unaffected.
Native Slack key connection is disconnected	The stored copy is removed; the original key remains active.
One MCP OAuth grant is revoked	Other clients’ separate grants remain independent.
A request was already sent before disconnect	Disconnect cannot recall an in-flight write. Reconcile the result before retrying.

Keep credentials out of messages, screenshots, logs and URLs. For setup and recovery, see Slack and MCP.