403 Forbidden.
Create and manage keys at Account > API Access. See Account & API Keys for that, and the API Reference for how scopes appear in REST calls.
Key prefixes
Every key’s prefix tells you what it’s for and how long it lives:| Prefix | Type | Use it for | Expiry |
|---|---|---|---|
rmxu_… | Personal | Your CLI, MCP server, ad-hoc REST calls | Never expires |
rmxa_… | Automation | Provisioning automated discovery PRs (minted into repo secrets), CI, unattended scripts | 365-day TTL |
sha256(key). The plaintext is shown once at creation, then rendered as rmxu_…last4 for identification.
Scope catalog
Scopes arecategory:access. Access is either read or write, and write implies read for the same category.
| Category | read grants | write grants (includes read) |
|---|---|---|
account | View your profile, teams, and key metadata | Update profile and team settings |
projects | List and read projects | Create and modify projects |
interests | List and read Research Interests | Create, update, toggle, and delete interests |
recommendations | Read recommendations and digests | Refresh recommendation pools |
papers | Read papers and asset search | (read-only; no write scope) |
experiments | List and read experiments | Create, update, and decide experiments |
evals | Read eval builds, runs, and templates | Create/run/cancel evals; manage templates |
workflows | Read workflow definitions and state | Create and modify workflows |
integrations | Read OAuth connection status | Connect/disconnect providers, manage tokens |
github | Read GitHub App installation info | Mint installation tokens, push branches, open PRs |
provisioning | Read provisioning status | Provision repos and mint CLI/automation tokens |
papers is read-only; there is no papers:write. The deprecated models/datasets surface is not in the scope catalog; those routes are reachable only with a legacy full-access key.Resource-qualified grants
A scope can be narrowed to a specific resource by appending its UUID:Presets
When creating a key you can apply a one-click preset instead of picking scopes by hand:| Preset | Scopes granted | Recommended key type |
|---|---|---|
| Read-only | read across the catalog | rmxu_ |
| Outrider setup | provisioning:write, interests:write, github:write, and more | rmxa_ |
| Experiment CI | experiments:write, evals:write, projects:read | rmxa_ |
| Digest bot | recommendations:read, papers:read, interests:read | rmxa_ or rmxu_ |
Which surface needs what
| Surface | Key type | Recommended scopes |
|---|---|---|
| CLI / MCP, personal use | rmxu_ | A broad personal key (or Read-only if you only consume data) |
| Automated discovery PRs (repo automation) | rmxa_ | Outrider setup preset |
| CI pipelines | rmxa_ | Experiment CI preset |
| Digest / notification bot | rmxa_ | Digest bot preset (optionally resource-qualified to one interest) |
Related
Account & API Keys
Create, scope, and revoke named keys
API Reference
REST endpoints and authentication
Connectors
OAuth connections (GitHub, HuggingFace, and more)
CLI
Authenticate the CLI with a personal key