Access and permissions
Choose what your assistant may read or change, and understand credits and live sends.
Your assistant acts through the API key you give it. MCP does not grant extra access: workspace membership, token type, scopes and API availability still apply.
Choose your key
| Credential | Best for | Limits |
|---|---|---|
Workspace API key (acq_org_…) | A shared integration or an assistant managing one workspace. | One workspace. Required for campaign changes and lead-search tools. |
Personal access token (acq_live_…) | Reading campaign information across your eligible workspaces. | Follows your access; cannot perform campaign write operations, even with campaigns:write. |
Create or replace a key. Removing a user's workspace access removes the personal token's access there. A workspace key belongs to the workspace and should be managed and revoked separately.
Start with the access you need
| Task | Scopes |
|---|---|
| List workspaces and read campaign results | workspaces:read, campaigns:read |
| Also inspect or export campaign leads | Add campaignLeads:read |
| Create drafts, edit sequences, preview or run campaign lead searches, launch or pause | Add campaigns:write; use a workspace key |
| Propose filters or preview a standalone lead search | leads:read; use a workspace key |
| Run a paid standalone lead search | leads:search; use a workspace key |
| Register an event webhook | webhooks:write; personal-token users must also be workspace owners or admins |
For standalone lead tools, add workspaces:read only if your assistant also needs to discover or read workspaces. It is not required when you already supply the workspace ID.
campaigns:write includes both drafts and live actions. There is no separate draft-only scope. A free campaign lead preview also requires this write scope, even though the preview itself does not bill or attach leads.
Understand the effect before allowing a change
| Action | Effect |
|---|---|
| Read results or existing leads | Views information without changing the campaign. |
| Generate lead filters or preview matches | Does not run the paid search or spend lead-search credits. |
| Create a draft | Does not launch it. Configured campaign-created automations may run. |
| Execute a lead search | Can spend credits. Campaign searches attach leads; active campaigns can begin contacting those new leads. |
| Launch or resume | Starts real outreach and can spend money. |
| Pause | Requests a stop to further sends. Messages already handed off may still be delivered. |
Ask the assistant to show its intended changes before taking action, but do not treat that wording as a security control. Client approval prompts vary. The API key's scopes enforce what the assistant can do.
For paid searches, always use a stable idempotencyKey and keep it for retries. Understand tools and operation status.
Disconnect or revoke access
Remove the server from your client to stop using that connection. Revoke the key in Acquisity to stop future requests from every client using it. If you suspect the key was exposed, revoke it and create a replacement.
Disconnecting or revoking a key does not undo changes, cancel accepted operations or pause campaigns already launched. Pause the campaign separately when that is your intended action.