Token guardrails
Guardrails
- Tokens are user-created and revocable in Airtape settings.
- Raw tokens are shown once after creation.
- Server storage keeps hashed token values, not plaintext.
- Scopes are enforced at the agent route layer.
Agent API for Personal AI Assistants
Use scoped personal access tokens to give a user’s own assistant access to the concrete Airtape operations that matter: create, schedule, invite, and return the join link.
After signup, create a token in Settings > Security
POST /api/agent/sessions
Authorization: Bearer atp_your_personal_token
{
"title": "Founder interview",
"scheduled_at": "2026-04-02T14:00:00Z",
"participants": [
{ "email": "[email protected]" }
]
}A token carries only the scopes the user grants. Scopes are enforced at the agent route layer.
sessions:writeCreate sessions and update scheduling details.
invites:writeAdd invitees and let Airtape send invitation mail.
sessions:readRead session metadata and fetch the join URL.
Four calls cover the whole scheduling workflow.
If the goal is personal agents first, start with the Airtape skill page and a token carrying only the scopes the user actually needs.