What can a connected AI tool or API key access in Vamo?

A connected AI tool or API key holds at most six permissions in Vamo. They are search, deep search, deep research, fit ranking, lists and contacts. It can never reach projects, outreach, members, billing or key management. Permissions are chosen for each key. Every key and connected tool is listed in one place, where it can be turned off.

What a key or connected tool can do

Access from outside the Vamo app is limited to finding and organizing developers.

• Search. Run developer searches in plain language, with filters, and look someone up by GitHub login.
• Deep search. Run deep searches.
• Deep research. Ask for an in-depth report on a developer or a repository, and read finished reports.
• Fit ranking. Rank developers against a role.
• Lists. Read lists and the developers on them, create lists and change their contents.
• Contacts. Read contacts and their details, add and edit them, and get email addresses for a list.

On the direct API, a key can also read which account and plan it belongs to, its own permissions, and its usage. The MCP server cannot read account, usage or billing information.

What it can never do

These permissions cannot be given to any key or connected tool, by anyone:

• Projects. Projects stay in the Vamo app.
• Outreach. A key cannot send email, start a sequence or change one that is running.
• Members. A key cannot read who is on the account, invite anyone or change a role.
• Billing. A key cannot change the plan or payment method.
• Key management. A key cannot create another key or revoke one.

Each of these takes a person signed in to the Vamo app.

Permissions are chosen per key

Each API key carries its own permissions. The person creating the key picks a preset or sets each permission one by one. The presets are full access, read only, search and enrich, and lists and contacts.

Full access means all six permissions above. It does not unlock anything on the second list.

Give each key the least it needs. A key that only searches does not need lists or contacts. Owners, admins and users can create keys. A read-only member cannot.

Tools that sign in hold no key

Some AI tools connect by browser sign-in. The tool opens a Vamo page, a person approves it, and the tool is connected. No API key is created, copied or stored by the person.

This suits a company that does not allow API keys. A signed-in tool gets the search and enrich permissions by default. Vamo records who approved it. After 90 days without use, the tool must sign in again.

Sign in or API key compares the two in more detail.

Where access is listed and removed

Open Set up > API keys. The page lists API keys and, under Connected tools, the AI tools signed in with a browser. Each key shows when it was last used.

A member sees their own keys. Owners and admins see every connected tool on the account, with who approved each.

Revoking a key turns it off. Removing a connected tool disconnects it. There is no rotate for keys. To replace one, create a new key and revoke the old one.

What to do next

• See and remove connected tools and keys walks through the page a reviewer will want to see.
• Keep your API key safe covers where a key should and should not live.
• Hosts to allow lists what a network needs to permit.