Agent API tokens are Sanctum personal access tokens. They are not Support API keys (bos_…).
Default Scopes
read, meetings, documents, profile, actions, memory
Opt-in
billing, team, and admin (staff only)
Show the secret once. Store it like a password. Maximum 10 tokens per person. Revoke in Settings.
Send Idempotency-Key on POST/PATCH that create or start work. Destructive operations also need X-Confirm: true.