Per-customer AI keys for agencies

Last updated:

When to use a per-customer key

If you run marketing for clients, a per-customer key lets an AI assistant work on one customer's marketing and nothing else. Every request made with the key is limited to that customer's workspace, so the assistant cannot see your own marketing or any other client's, even if asked to.

Typical uses:

  • giving a client's marketing manager their own Claude connection to their campaigns and lists,
  • keeping your own AI work on a client cleanly separated from other clients.

For your own day-to-day use across modules, a personal connection is simpler. See Your personal AI connection.

Issue a key

  1. As an admin, go to Marketing, Settings, API keys & MCP.
  2. Choose New API key.
  3. Fill in the form:
    • Name: an internal label, for example "Acme Ltd marketing team". It appears in the key list and audit trail.
    • Scopes: marketing:read to read campaigns, lists, subscribers, social posts and analytics; add marketing:write to let the assistant create drafts such as email broadcasts, social posts, campaigns and mailing lists.
    • Per-customer scope: pick the customer. This is what limits the key to their workspace. Leave it empty only if you want a key for your whole organisation (Full tenant).
    • Expires (optional): recommended for keys you give to someone outside your company.
  4. Choose Issue key and copy the key straight away. It starts with pk_ and is only shown once.

Build the connector URL

Add the key to your workspace's Marketing endpoint:

https://YOUR-WORKSPACE.chorum.io/api/mcp/marketing/rpc?key=pk_YOUR_KEY

That single URL is all an AI assistant needs. Scripts can use the URL without ?key= and send Authorization: Bearer pk_... instead.

Connect the assistant

  1. In Claude, open Settings, Connectors, choose Add custom connector, name it after the customer (for example "Acme marketing") and paste the URL. Leave the OAuth fields blank and choose Add.
  2. Start a new conversation and ask "List the marketing campaigns". Only that customer's campaigns should appear.

You can add several connectors side by side, one per customer, and keep them clearly named.

Managing keys

  • The key list shows each key's name, prefix, customer scope, when it was created and when it was Last used.
  • Choose Revoke to switch a key off. It stops working immediately, and the record stays for your audit history.
  • Every request made with a key is logged.

Tips

  • Give each person or tool its own key, so you can revoke one without affecting the others.
  • Start clients on read access, and add write access once they are comfortable reviewing AI drafts.
  • Set up the customer's brand kit first, so anything the assistant drafts follows their brand. See Setting up your brand kit.

Troubleshooting

  • "Invalid or revoked API key": check the whole key was copied (it starts with pk_) and has not been revoked. Lost keys cannot be shown again; issue a new one.
  • The assistant cannot create anything: the key has read scope only. Issue a new key with marketing:write.
  • No data comes back: check the key's customer scope matches the customer you expect.
  • Request for an OAuth Client ID: the URL reached Chorum without the key. Paste the full URL again, then delete and re-add the connector.

Related articles