Authentication
API keys, OAuth tokens, scopes and access presets.
Send a token in the Authorization header:
Authorization: Bearer rsl_live_…| Token | Prefix | Use |
|---|---|---|
| API key | rsl_live_ | Scripts, CI, server integrations, headless agents. Created in Settings → Developers. |
| OAuth access token | rsl_oat_ | Issued to MCP clients, the CLI and third-party apps after you approve access. Valid 1 hour. |
| OAuth refresh token | rsl_ort_ | Exchanges for a new access token. Valid 30 days, rotates on every use. |
Keys and tokens are stored hashed; Resolido shows a key only once. Revoke any key or connected app in Settings → Developers, which also shows the last calls made with it.
Who a token acts as
A token always acts as the user who created it, in exactly one organization. Its effective permissions are the user's role in that organization intersected with the token's scopes. If the user's role is reduced or they leave the organization, the token loses access immediately.
Presets
When you create a key or approve an app you pick a preset:
| Preset | Scopes |
|---|---|
| Read only | Every :read scope. |
| Inbox | conversations:read, conversations:write, conversations:reply, contacts:read, contacts:write, automation:read, agents:read |
| Full access | Everything except conversations:delete and members:write. |
Scopes
| Scope | Allows |
|---|---|
org:read / org:write | Organization profile and settings |
members:read / members:write | Team members and invitations |
agents:read / agents:write | AI agents, prompts, critical instructions, chat widget |
knowledge:read / knowledge:write | Knowledge sources and search |
skills:read / skills:write | Custom skills (HTTP tools) |
channels:read / channels:write | Email mailboxes, sending domains, WhatsApp |
conversations:read | Reading conversations, messages, notes and AI traces |
conversations:write | Notes, tags, assignment, snoozing, resolving, trash |
conversations:reply | Sending replies and emails to customers |
conversations:delete | Permanently deleting conversations |
contacts:read / contacts:write | Contacts, contact groups, blocking |
automation:read / automation:write | Inboxes, quick replies, tags |
insights:read / insights:write | AI-detected improvement suggestions |
stats:read | Statistics and usage |
testing | Chatting with agents as a test customer and testing skills |
A call without a required scope fails with 403 scope_missing; the hint names the scope.