Integration & agent users

Give a script or an AI agent its own account, not a person's login and never the Administrator. Create a dedicated user, grant it only the roles the job needs, mint its API key, and hand that key to the integration. The key inherits exactly that user's permissions, so a scoped user is your main control over what an integration can reach. Mark it as an agent account and it stays out of your billable seat count. This page covers creating the user, minting and rotating its key, and reading what it did.

Why a dedicated user

• The key is the user. Whatever the user can read and write, the key can read and write. Scope the user and you have scoped every key it holds.
• Revoke without disrupting a person. Deleting a service account's key stops the integration and touches no one's login.
• Clean audit. Actions are attributed to the service account, so you can see what the integration did separately from what people did.

Create the user

1. Go to Settings → Users & Companies → Users → New.
2. Name it for its job, not a person — for example "CRM Sync" or "Support Agent".
3. Set a login and email address you control.
4. Under Access Rights, grant only the roles the integration needs. Leave Administrator off.
5. Save.

Never give an agent or bot the Administrator role. A least-privilege user can only reach what you granted, and the MCP server refuses any attempt by a tool to grant the Administrator group, rolling back a write that would. So even a leaked key can't escalate itself.

Mark it as an agent account

Agent and bot accounts don't count toward your billable seats when they are marked as agent accounts (the is_everjust_agent flag on the user). There is no self-serve checkbox for the flag: on workspaces with agents enabled, we set it when we provision an agent account. Ask us to mark a service account you created yourself, and it drops out of the seat count.

Mint its API key

Keys are minted from a user's own profile, so mint the key while signed in as the integration user.

1. Sign in as the integration user (or open its record and set a password you control, then sign in).
2. Open Profile Settings from the avatar menu.
3. On agent-enabled workspaces, go to the API & AI Agent tab and click Connect an AI agent for a ready-to-paste MCP config; otherwise use New API Key in that tab, or under Account Security.
4. Copy the key once (it is shown a single time) and store it in the script's or agent's secret store, never in a committed file.

The one-click key is valid for one year. Hand the key to the integration and point it at https://<workspace>.everjust.app — see External API for scripts and AI agents & MCP for agents.

Tighten or revoke access later

• Change scope. Edit the user's roles or record rules. It takes effect on the next call, with no redeploy.
• Cut access now. Delete the key in the same tab where you minted it. The integration stops working at once.
• Rotate. Mint a new key, move the integration onto it, then delete the old one. One-click keys also expire after a year on their own.
• On a leak. Delete the leaked key and mint a fresh one. A key can't be recovered once lost, which is fine: a new one takes its place.

Review what an agent did

Every MCP tool call is written to the workspace audit log, everjust.mcp.log: the acting user, the tool, the model and method, a summary with secret values redacted, the record count, success or failure, the error if any, and the timestamp. The log covers /mcp only; plain JSON API and classic RPC calls are not recorded.

The log is readable by administrators and immutable — nobody can edit or insert rows through the app, and rows auto-prune after 90 days. No dedicated screen ships for it; read it with an admin key over the API. For example, the last 50 failed agent calls:

curl -X POST https://acme.everjust.app/json/2/everjust.mcp.log/search_read \
  -H "Authorization: Bearer ADMIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": [["success", "=", false]],
       "fields": ["create_date", "user_id", "tool", "model_name", "error"],
       "limit": 50, "order": "create_date desc"}'

A connected agent can read the same log with the MCP search tool on everjust.mcp.log, if its user is an administrator.

Related

• AI agents & MCP — connect an agent to the key you minted here.
• MCP tool reference — the tools that key can call.
• External API — call the JSON or XML-RPC API with it.