Developer access and widget tokens
There are no API keys on Developers: REST and MCP server calls run as the signed-in platform identity. The only credential Elie mints is a scoped token for the embeddable widget, shown to you once.
- The Knowledge Base module visible in your left-hand navigation.
- This permission: Knowledge Base · Kb — UPDATE.
- Issuing or revoking a token needs the same permission that saves knowledge base settings. Reading the API reference needs nothing extra.
If Knowledge Base isn't in your navigation, your role doesn't have visibility for it — ask a workspace administrator, or see Permissions and module visibility.
Steps
Open your knowledge base and select Developers. It opens on API reference.
API reference is read-only — the REST Endpoints, MCP server tools and IntELIEAgent tools manifest, each against the Required permission the backend enforces. Copy the Base URL and KB id from there.
Select Embeddable widget. Under Scoped tokens, enter the Audience origins allowed to load the widget, set Expiry (minutes) and select Issue token. Get embed code → Issue token & generate mints one and writes the Embed code, always for the knowledge base you opened — not the modal’s Knowledge base picker.
The value appears once, under Issued this session — copy now, tokens are shown once: Copy it before you reload or leave. Select Revoke on its row to retire it, then confirm the widget is refused — the row goes either way.
What success looks like
- The token is listed under Issued this session — copy now, tokens are shown once, with its origins (or No origin restriction) and minutes left.
- A widget on an allow-listed page answers; with a revoked or expired token it is refused.
What a scoped token can reach
It reaches Unrestricted and public content only; per-document access still applies server-side. Audience origins — Embedding domains in the embed modal — decide which pages may load the widget, not what it can read. Expiry is capped by the platform limit (60 minutes by default), so trust the minutes on the row.
If something goes wrong
| Symptom | Likely cause | What to do |
|---|---|---|
| You no longer have the token value. | Tokens are shown once, in the page only. | Issue a new one — the lost token stays valid until it expires, and cannot be revoked here. |
| The widget loads but every question is refused. | The page's origin is not in Audience origins, or the token expired or was revoked. | Issue a token matching that page's exact scheme, host and port. |
| The pane is replaced by Access Forbidden. | Issuing and revoking need the permission that edits the knowledge base. | Ask an administrator — see Permissions. |
Next
- Knowledge Base API — the wire contract behind these surfaces: request and response fields, the embed snippet's options, and every error code.
- Access — the layers a token still obeys.
- Settings — same permission, wider effect.
- Asking questions — what widget readers experience.