No key carries "à la carte" permissions by default: it inherits an already-defined set of permissions, sealed the moment it's created (section 2). - **Personal key**: exactly what your role could do in the API when you created it — a viewer can only read, an editor can also operate day-to-day, an admin has full access (detail of each role: Manual 15, section 4). - **Company key**: always an administrator's full set, regardless of the role of whoever created it. That full set is the key's **ceiling** — the creation form (section 4) lets you narrow it down, never widen it, with the **"What this key can do"** section: it shows collapsed by default, with a one-line summary ("Everything your role can do." for a personal key, "Everything an administrator can do." for a company one) and a **"Customize"** link. If you don't touch anything, the key is created with the full ceiling — the same behavior as always. Tapping "Customize" expands a **"View"** checkbox and a **"Manage"** one for every area (Leads, Conversations, Knowledge base, Documents, Calendar, Tickets, Contacts, Marketing, Channels, Integrations, AI agents, Tags, Settings, Billing, Team, Security…), all checked at first. Uncheck what that key does **not** need: only the areas you leave checked travel with the key. > **Note — Unchecking everything is also a valid option** > > If you uncheck every box, the Platform warns you before creating the key: "You haven't checked anything: > this key will be created with no permission to do anything." It isn't an error — sometimes it's useful to > have a "parked" key with no permissions yet. Once narrowed down, the keys table (sections 4 and 5) summarizes the result in the **"What it can do"** column: "Everything ({role})" (for example "Everything (Admin)") if you didn't narrow anything down, or an "N area(s)" link if you did — tapping it opens the exact detail, area by area. These permissions are checked on **every request**, on the server — the key never "skips" any role check that already applies to the rest of the API, and the narrowing stays fixed forever on that key (just like the rest of its permissions, section 2): to change it you have to revoke it and create a new one (section 9).