A workspace has an owner and, depending on the plan, admins and members. A role decides what a person can do, and an API key never goes beyond its creator’s role in the workspace it reaches.
Not in the API yet. The feature exists in Tarkle. Its API is planned and this page shows where it will live.
API coverage
| What | Status | Where |
|---|---|---|
| List members of a workspace | Planned | Not in the API yet |
| Invite and remove members | Planned | Not in the API yet |
| Change a role | Planned | Not in the API yet |
Roles are already part of every API call. Tarkle looks up the creator’s current access to the workspace on each request, and brand calls need the creator to be an owner or admin of that workspace. See Authentication.
Access
Only an owner or admin of the organization can manage API keys in Settings > API. Every key holds every scope except purchases (billing:purchase), so it can read and write everything the API and the MCP server can do in the workspaces it reaches. A new key has no scope choice.
A key made with all workspaces reaches every workspace of the organization. A key limited to selected workspaces gets 403 no_access for any other workspace. Every call inside a workspace names it with its workspace key (see Authentication).
Keys made before 2026-11-04 keep working. Some of them show a Legacy badge: they keep their older, limited permissions, and a Legacy key does not open the MCP server. Create a new key in Settings > API to get the full set.
Related
- Start with the Quickstart
- API keys: create, limit and delete a key.
- Help center: how to use this in the app.
- Not in the API yet: everything planned.