Skip to main content
An agent is only as trustworthy as the credential you give it. Pureframe AI’s controls for agent access are the same ones that control any API key — there’s no separate agent-specific permission system.

​
Use a read-only key

Create an API key with permissions: "read_only" specifically for agent integrations that only need to search (see API Keys). A read-only key can call search_videos, list_collections, get_collection, and get_video, but not upload_video or any write/delete operation — even if a prompt injection attempt tries to talk the model into it.

​
What’s scoped, and what isn’t

An API key is scoped to your account — it can access every collection and video you own, and nothing outside your account. There’s currently no way to restrict a key to a subset of collections (a “this agent can only see the Marketing collection” allowlist doesn’t exist yet). If you need to give an agent narrower access than your whole library, the practical option today is a separate Pureframe AI account holding only the collections that agent should see.

​
Revocation is immediate

If an agent integration is compromised or misbehaving, revoke its key from the API Keys dashboard — in-flight and future requests using it are rejected within seconds. Keys are stored as a SHA-256 hash server-side, so Pureframe AI can’t recover or display the plain secret after creation, only revoke it.

​
Rate limits apply the same way

Agent tool calls share the same per-key rate limits as direct REST calls — 30 requests/minute for search_videos. A runaway agent loop hits 429s, not unlimited API usage. See Rate Limits.

​
Remote MCP authentication

The hosted remote MCP endpoint (https://mcp.pureframe.ai) authenticates the same way as the REST API — a Bearer token in the Authorization header, passed through by your MCP client’s config. There’s no separate remote-specific credential type.