> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tiro.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage API keys and connections

> Find who can manage organization and workspace API keys or OAuth apps, and what to do if a credential is exposed.

엔터프라이즈 For Enterprise organization admins.

Use [Tiro Platform](https://platform.tiro.ooo) to manage API keys and OAuth apps. Select the account, workspace, or organization you want to manage. OAuth apps are managed in the organization view.

## Who can manage each connection?

| Item | Who can manage it | Where |
| - | - | - |
| Organization API key | Organization Admin or Developer | Select the organization, then open API Keys |
| Workspace API key | Workspace admin | Select the workspace, then open API Keys |
| Account API key | The member | Select the account, then open API Keys |
| OAuth app | Organization Admin or Developer | Select the organization, then open OAuth Apps |
| AI app (MCP) connection | The member | Connection settings in the AI app |

See [What data can connected apps see?](https://docs.tiro.ooo/en/enterprise/data-access.md) for each key's note access.

## What can I configure on an organization API key?

* **Permissions**. Grant only the scopes the integration needs. Granting all scopes does not expand the notes that an organization key can see.
* **Workspaces**. Allow all current and future workspaces or select specific workspaces.
* **Expiration**. Set an expiration date for a time-limited integration.
* **Allowed hosts**. Restrict where the key can be used. Manage organization-wide rules in [Organization Security](https://docs.tiro.ooo/en/guide/privacy/enterprise-security.md).

Tiro displays a newly created key only once. Save it securely before leaving the page.

## How do I manage OAuth apps?

An OAuth app lets an internal system access a member's notes with their consent. Follow the [OAuth apps guide](https://docs.tiro.ooo/en/developers/fundamentals/oauth.md) to register one. In the app list, you can pause new authorization requests while leaving existing tokens in use. Resume authorizations before a member tries to connect again. Regenerating the client secret invalidates the old secret immediately, so prepare to update the server configuration.

## What should I do if a key is exposed?

Delete the affected key and replace it in your integration. Deletion immediately stops integrations that still use the old key. If an OAuth client secret was exposed, regenerate it and update your server configuration.

## Where do I set up SSO and SCIM?

Work with your account manager to configure SSO and SCIM with your organization's identity system. See the [organization admin guide](https://docs.tiro.ooo/en/enterprise/org-admin.md) for what to prepare.

**Related pages** · [Data access for connected apps](https://docs.tiro.ooo/en/enterprise/data-access.md) · [Organization Security](https://docs.tiro.ooo/en/guide/privacy/enterprise-security.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.