Keep your Vamo API key safe

A Vamo API key lets a tool act on your account, so treat it like a password. Store it where your tool reads it, and never paste it into a chat or a shared file. Give each tool its own key with only the permissions it needs. Revoke a key whenever you are unsure who has seen it.

Who can create a key

Keys are created at Set up > API keys in the Vamo app.

API keys are on the Pro and Enterprise plans. On other plans the page says so.

Your role matters too. An owner, an admin or a user can create a key. A read-only member cannot. If that is you, ask an owner or admin on your account.

The number of keys on an account is capped by its number of seats. At that number, creating a key fails with "API keys are not included on your plan." Revoke a key nobody uses, then create the new one.

The key is shown once

Vamo shows the full key one time, right after you create it. Every Vamo key begins with vamosk. After that the page shows only the beginning and the last four characters.

Copy the key straight to the place your tool will read it. If you lose it, nobody can show it to you again, including Vamo. Create a new key and revoke the lost one.

Where an agent looks for the key

An agent using the Vamo skills looks for the key in two places. It checks its environment first, under the name VAMO_API_KEY. Then it checks a private Vamo settings file on your own computer.

Both places keep the key out of the conversation. The agent reads the key when it needs it, and you never type it again. The skills install page has the current steps for each tool.

You can avoid handling a key at all. The Pick your tool section at Set up by hand writes a setup line for your tool. That line carries a single-use code, and your agent trades it for a key. Some tools can also sign in through a browser, which uses no key. Sign in or API key compares the two.

Where a key should never go

• A chat message to an AI tool. The key becomes part of the conversation.
• An email, a team chat or a shared document.
• A screen share or a screenshot.
• A code repository. Committed files keep their history, so deleting the key later does not remove it.

To check a stored key works, ask your agent without showing it:

Check that you can reach Vamo with the key you have stored. Do not print the key.

One key per tool

Give every tool its own key, and name it for the person or agent that uses it. Then you can turn off one tool without stopping the others. The Last used date on each row tells you which keys are still in use.

Choose only the permissions that tool needs. Vamo offers four presets: full access, read only, search and enrich, and lists and contacts. You can also pick permissions one by one. The picker only offers access that your plan and your own role hold.

No key can reach projects or outreach sequences. Those stay in the app.

Revoke on doubt

If a key may have been seen by someone else, revoke it. Do not wait to find out. Revoking takes effect immediately and cannot be undone. Anything still using that key starts getting an unauthorized error.

Vamo has no rotate. Replacing a key means creating a new one and revoking the old one. A member can revoke their own keys. Owners and admins can revoke any key on the account.

What to do next

• See and remove tools and API keys walks through the key list and replacing a key.
• Keep agent usage in check covers what a tool can use once it holds a key.
• API errors explains the unauthorized and forbidden errors a tool can get.