Agent Access overview

Open My settings → Developer access → Agent access to manage the non-browser access attached to your own identity. API keys, OAuth applications, and connected grants are personal; workspace-wide connector and identity-provider settings remain in Administration.

API keys

API keys are suitable for server-to-server scripts and clients that can safely store a bearer secret.

1. Select API key.
2. Give the key a recognizable name.
3. Choose only the permissions the integration needs.
4. Set an expiration when the workflow has a known lifetime.
5. Store the displayed secret immediately; the complete secret is shown only after creation.

The table shows key prefix, last four characters, permissions, creation, expiry, last use, and revocation state.

OAuth applications

OAuth is recommended for interactive remote MCP clients such as ChatGPT and Claude.

1. Select OAuth app.
2. Enter the client name and exact redirect URI supplied by the agent platform.
3. Permit search:read, knowledge:read, or both.
4. Store the client secret if the client uses confidential authentication.
5. Complete authorization from the agent client while signed in to CogLake.

Connected grants are listed separately and can be disconnected without deleting the application registration.

Delegation rules

A token can only delegate permissions allowed for the signed-in user and client. OAuth access to the built-in MCP server is intentionally limited to:

• search:read
• knowledge:read
• offline_access for rotating refresh tokens

The resulting agent still receives only documents visible to the authorizing user and their roles.