Skip to content
txcast txcast txcast docs

Agent credentials, scopes, and account grants

Create a credential

Section titled “Create a credential”
  1. Open Organisation settings → Agent access.
  2. Enter a name that identifies the client and purpose.
  3. Choose read-only, authoring, full lifecycle, or exact custom scopes.
  4. Choose a selected controlled-account grant whenever practical.
  5. Keep the default 30-day expiry or choose a shorter custom date.
  6. Reauthenticate and create the credential.
  7. Copy the txc_… secret into a password manager or environment variable before closing the dialog.

txcast stores only a SHA-256 hash. The secret cannot be recovered.

Scope presets

Section titled “Scope presets”
  • Read-only: organisation context and resource reads.
  • Authoring: reads plus contract registration and workflow drafting/publication.
  • Full lifecycle: every current scope except public-link creation.
  • Custom: exactly the selected scopes.

Public visibility is deliberately separate. Grant it only if the agent may expose a run outside the organisation.

Account grants

Section titled “Account grants”
  • selected fixes access to named execution-account IDs. An empty selection is deny-all and is appropriate for read-only work.
  • all dynamically includes current and future organisation execution accounts.

The grant limits workflow references and execution actions, not contract targets or ordinary organisation reads.

Live checks and rotation

Section titled “Live checks and rotation”

Every request rechecks expiry, revocation, email verification, membership, seat, role, ownership rules, scopes, and relevant account grants. Changing or removing any of these can disable a credential immediately.

Scopes and grants cannot be widened in place. Create a replacement, update the client, verify it, then revoke the old credential. A password reset revokes all credentials owned by that user.