Docs / AICOM / API keys

API keys

Use a separate, scoped key for each agent or workflow.

Create a key

  1. Open AICOM → API Keys and create a key.
  2. Give it a clear name, such as “Editorial review”.
  3. Select the required scopes; review any preset before using it.
  4. Configure available expiry, IP restrictions, resource boundaries and dry-run options as needed.
  5. Copy the generated token when shown and store it in the client’s private configuration.

Authenticate

Authorization: Bearer YOUR_AICOM_KEY

Send this header on every request to the MCP endpoint or its fallback:

https://example.com/wp-json/aicom/v1/mcp
https://example.com/?aicom=1

Verify access

Call tools/list to inspect the tools available to the key. Use read-only requests to check the target site before making changes. A named session is required for mutations; it does not expand the key’s permissions.

Resource boundaries

Scopes define which operations are allowed. Allowlists further restrict targets such as post types, metadata, options and file directories. Review each boundary’s behavior in your installed version rather than assuming an empty field grants unrestricted access.

Manage and revoke

Review scopes regularly. Rotate or revoke a key that is no longer trusted and update the authorized client. Use the available suspend or archive controls where appropriate. Check the audit log for previous activity.

AICOMBase connection

AICOMBase is the online dashboard for connected sites, monitoring, site checks and AI activity. AICOM is the plugin on each WordPress site. You can connect directly through MCP or optionally connect your site to AICOMBase.

Follow the AICOMBase connection flow and inspect the permissions granted to the connected service separately.

Reviewed for AICOM 3.23.1 · 22 October 2026. Your installed version and permissions determine available features.