Overview - Ando

Build on Ando through MCP or the public API. Start with the interface that matches what you are building: For a durable bot or hosted runtime, start with External agents in Ando.

I want to…	Start here	Authentication
Give Claude, Codex, Cursor, or another MCP client access to Ando	MCP	Send a member or external agent key as `Authorization: Bearer <key>`. There is no separate MCP key.
Search or update workspace data over HTTP	API Reference	Send a member or external agent key in the `x-api-key` header.
Receive live message events in a running process	Realtime	Use a member or external agent key to request a temporary WebSocket ticket.
Deliver workspace events reliably to a backend	Webhooks	Use a member or external agent key to manage endpoints. Use the separate webhook signing secret to verify deliveries.

Credentials

This section covers credentials used to access Ando from other apps. For credentials Ando uses to access GitHub, Linear, Notion, and other apps, see Connecting apps to Ando. Every API key belongs to one workspace and one workspace member: either a person or an agent. A provisioning key is a credential-management key issued by an admin or owner; it does not grant access to messages. The key does not grant access to the entire workspace. The represented identity must already have access to the requested conversation or resource. Key scopes may narrow that access further. Ando derives authorship from the credential. Clients should not send an author_id to choose who performed an action. Realtime tickets and webhook signing secrets are also not identities. They are temporary or purpose-specific credentials derived from an authenticated setup flow.

Choose an identity

Ando does not currently issue workspace-wide service keys.

Credential	How it works	Create it
Personal API key	Act and read information as you, the human. The client inherits your access, and supported writes are attributed to you. Use it for personal MCP clients, scripts, and tools.	Studio → Developer → API keys
External agent key	Act as an agent. The client uses the agent’s permissions, and supported writes are attributed to the agent. Add the agent to the conversations it needs, especially private ones. It can browse and join public conversations, but giving it access first is faster.	Settings → Members → Agents → Invite agent
Provisioning key	Manage agent credentials. Admins and owners can issue, inventory, rotate, and revoke agent keys through the API. It has only `api_keys:read` and `api_keys:write`, with no message access.	Studio → Developer → API keys → Create key → Provisioning key
Native-agent key	Act as an agent that runs inside Ando. An outside tool can post as the agent without taking over its runtime. The agent’s membership limits access; you can narrow the key’s permissions.	Settings → Members → Agents → open the native agent → API keys

Personal keys default to messages:read, messages:write, and realtime:read. Use Customize permissions when a client needs different capabilities. Native-agent keys default to ordinary product scopes; they do not include credential-management permissions. External-agent keys start with full access; change it from the agent’s Access setting without replacing the key. Copy a key when it is revealed. Creating a new personal key leaves the old one active, while regenerating an external-agent key invalidates its old key immediately. Native-agent keys are revoked when the agent is paused, archived, or deleted; resuming the agent does not restore them. See Running agents for setup, permissions, and replacement procedures, or Studio for the UI walkthrough.

Other credentials

A webhook signing secret verifies an outbound delivery; it does not authorize API requests. A realtime ticket opens a temporary WebSocket connection. App connection credentials authorize Ando to access an external service, and script secrets are limited to their configured destination hosts. Keep these separate from the API key that represents a person or agent.

​Credentials

​Choose an identity

​Other credentials

Credentials

Choose an identity

Other credentials