Restrict an API key to a workspace folder

A workspace and folder anchor limits where a credential can reach. Use it for applications that should see only one project tree.

Before you start

• Use a disposable workspace and non-confidential test file.
• Choose the smallest permissions and surfaces the task requires.
• Prepare a password manager or secret store; never place a real key in a screenshot, URL or repository.
• Plan to revoke the test key after verification.

Steps: restrict an api key to a workspace folder

1. Create a key and choose the intended workspace under Where can it reach.
2. Select the folder anchor and verify its displayed path.
3. Choose the required operation permission and protocol surfaces.
4. Save the one-time secret.
5. List or upload inside the anchored folder.
6. Attempt access outside the subtree and confirm it is denied.

Expected result

The test key performs its allowed operation, rejects an operation outside its boundary, and can be identified and revoked without changing the account password.

Limits and important details

• Moving or deleting the anchor can affect the integration.
• The anchor does not grant access that the owning account lacks.
• A folder anchor is separate from a human member folder restriction.

Troubleshooting

The request returns unauthorized. Check the complete secret, API endpoint and whether the key was revoked.

The request returns forbidden. Compare the operation with the key permission, protocol surface, workspace and folder anchor.

A secret was exposed. Revoke it immediately, create a replacement with least privilege and remove the exposed value from logs and history.

Related guides

• Create and manage an API key
• Choose key permission
• Restrict a member to a folder