API keys and AI agent rules

An API key is like a password for software: it lets an app, script or AI agent use chosen mailboxes without anyone signing in. It is shown once when created. Manage keys in Admin, API keys.

Create a key

1. Choose Create API key.
2. Enter a Name you will recognise later, like "CRM sync" or "Invoice agent". Agent actions are logged under this name.
3. Under Mailboxes, pick the only mailboxes the key can reach. Pick as few as the app needs. Anyone holding the key can use these mailboxes within the permissions, without a password or two-factor.
4. Under Permissions, give only what the app needs: Read messages and folders, Send mail, and Move, flag and delete messages. A reporting tool needs just Read.
5. If it is for an AI agent, switch on This key is for an AI agent to add rules (below).
6. Choose Create key, then copy the key. It is sent in the Authorization header as Bearer <key>.

Agent rules

Rules are enforced by PGB Business itself, on top of permissions. A set of ready-made starting points fills in the details, and you can adjust them (which switches to Custom).

What it may read. Mail outside these limits is invisible to the agent. Limit by folder and by sender addresses or domains, for example only the inbox and mail from vendor.com.

What it may send. A message that breaks any of these is "outside the rules":

• Recipients: Anyone, Known contacts only, People in this workspace only, or Only these domains. Every recipient (To, Cc, Bcc) must qualify.
• Most recipients per message, to stop accidental mass mailing.
• Messages per day. Days start at midnight UTC.
• Quiet hours: a daily window, for example 20:00 to 07:00 in a time zone, when anything the agent sends is held or refused.

When a message is outside the rules: Refuse anything outside the policy, Hold anything outside the policy for approval, or Hold every message for approval. Held messages wait in Approvals.

Choose Save rules. Changes apply within a minute. Messages already held keep waiting.

Pause or revoke

Each key's row has Pause (stops it until you resume it) and Revoke. Revoking stops apps using that key right away and cannot be undone. Revoke any key you no longer use or that may have leaked. Edit rules changes an agent key's rules later.

Tips

• One key per app, so you can revoke one without breaking others.
• For anything an agent sends to customers, start with Hold every message for approval.