Agencies

An agency groups the workspaces you run for clients. Each client keeps its own workspace, with its own mailboxes, contacts, campaigns and inbox, and the agency adds four things on top: your staff reach every client without being invited one by one, every client sends from one shared monthly pool, every client can draw on one shared AI balance, and the whole agency is billed once. There is no per-client fee and no limit on the number of clients.

Set up an agency

One account can own up to five agencies, and can be staff in any number.

The agency view

Staff run the agency from its own view, apart from any one workspace. Its header shows the agency's logo (or its initials) and name, the send pool and AI balance used this period, notifications and your account menu. When you are staff in more than one agency, the name opens a menu to switch between them. The workspace switcher and the workspace's plan, trial and balance prompts are not part of it.

The sidebar holds the agency's own pages:

Below the pages, Clients lists every client workspace with a dot for its health: red when something needs attention now, amber for a warning, green when all is well. Select a client to enter its workspace and open its dashboard. Add client at the end of the list opens the same dialog as Agency > Clients. On a phone, the menu button in the header opens the sidebar.

Inside a client's workspace, the left of the header shows your agency's mark and name with a back arrow, then the client's name. Select it, or Back to your agency in the workspace menu, to return to the agency view. Both are there on a phone too.

The workspace menu in the header and the workspace picker group what you can open by agency: each agency you are staff in comes first, labelled Agency, and opens the agency view, with its client workspaces listed under it. Your other workspaces follow under Your workspaces. Once the list is long, the menu has a search that covers agencies and workspaces alike.

When you sign in without a workspace picked, you land in the agency view instead of the picker. SenditCold also remembers which view you left: if you close the app in the agency view, opening it again returns you there. A link to a page inside a workspace still opens that page.

The pages that were tabs under /app/agency/settings/ now have their own addresses (/app/agency/clients, /app/agency/usage and so on), and the old links forward to them.

Clients

Each client is a workspace. Add one under Agency > Clients > Add client:

• New workspace opens a workspace for the client. The agency owner owns it, and your staff are added to it straight away. While the agency has an active plan (and always on a self-hosted instance), a client workspace you open this way does not count toward the owner's workspace limit. Until the agency has one, it counts toward that limit like any other workspace the owner creates. The daily limit on creating workspaces applies either way.
• Existing workspace brings in a workspace you own. It keeps its data and its members. A workspace that pays for its own plan has to cancel it first, so it is not billed twice.

A client workspace's plan comes from the agency. Its Settings > Billing page says Billed through and the agency's name instead of offering a checkout, and its own balance for AI usage stays where it was. When that runs out, it draws on the agency's shared AI balance.

Remove from agency (in the row's menu) detaches a client. The workspace and everything in it stay, along with members it added itself. It loses the agency's plan and goes back to its own, and staff the agency added lose access to it. Select a client's row to open its workspace.

View as client

View as client (in a client's row menu on Agency and Agency > Clients, and as Dashboard in the preview on Agency > Branding, which saves your branding changes first) opens the client's workspace the way its own members see it: your brand instead of SenditCold's, without SenditCold's plan, trial or balance prompts, and with only the pages and actions one role allows. It starts with the role most of the workspace's members hold; pick another role, or Owner, from the bar at the top of the page.

The view only narrows what you are shown. Every request still runs with your own access, so a role can never show you more than you already have in that workspace, and what you change there is changed for real. It lasts for that browser tab: Exit client view returns you to your own view of the workspace, and the back button returns you to the agency view (to Branding when you came from there). Opening another workspace ends it too.

A client can also take its workspace back. The workspace's owner opens Settings > Danger zone in that workspace and selects Leave agency, which has the same effect as Remove from agency. When the agency owner also owns the workspace (every workspace opened with New workspace), it is removed from the agency's side instead.

A workspace belongs to at most one agency. The link to an agency, and the agency's record of the sends and AI the workspace took from it, do not travel in a workspace export: an imported workspace starts outside any agency.

Staff

Staff are the people who run the agency. Add them under Agency > Staff by email:

Staff are added to each client workspace when it joins the agency and when they join the agency. Removing someone from the staff, or detaching a client, takes back only the memberships the agency added: someone a client invited directly keeps their access. Anyone can leave an agency they are staff in, except the owner.

Adding an address no SenditCold account uses yet saves an invitation. The person joins the agency the first time they sign in with that address, within 14 days.

The shared send pool

Instead of a daily cap per workspace, an agency's plan includes a number of campaign sends per billing period, shared by every client. A client with a quiet week leaves its share to the others, and nothing is lost on weekends.

Agency > Usage shows the period's pool, top-ups, sends so far, what is left, the days left in the period, and a projection: the sends you will reach by the period's end at the pace so far. Below it, each client's sends this period.

• The pool counts campaign emails sent by client workspaces since they joined the agency. Warmup does not use the pool.
• A send stays counted for the rest of the period. Removing a client, deleting a campaign or deleting the workspace does not give its sends back to the pool.
• The pool renews every month on the day your billing period started, on an annual plan too: a year on an annual plan is twelve monthly pools. Unused sends do not carry over.
• When the pool is used up, campaigns across your clients wait until the period renews or you add a top-up pack. They are not cancelled.
• Owners and admins are notified when the pool reaches 80% and 100%, once each per period.

A cap per client

Give a client a Monthly cap on the Clients page to hold it to part of the pool. The client stops sending campaigns once it has sent that many this period, even when the pool has more. A cap of 0 pauses the client's campaigns. Select No cap to remove it.

Per-mailbox safety still applies

A large pool never makes one mailbox send faster. Every mailbox keeps its own daily limit, minimum gap between sends, warmup ramp and health checks, exactly as described in sending behavior and warmup. To send more, connect more healthy mailboxes. The pool is a ceiling on the agency's total, not a target.

Like the daily limit it replaces, the pool is checked as campaigns send, so a busy period can go a few sends past it.

Billing and top-ups

Every client workspace gets the agency plan's features. Both plans include the CRM, the API and webhooks in every client workspace. Agency includes your logo, accent colour and portal domain on client pages, with a small "Powered by SenditCold" line. Agency Pro can remove that line, and adds sending kept apart from other customers. Agency includes $10 of shared AI a month and Agency Pro $30.

Sending kept apart on Agency Pro

On Agency Pro, each client workspace gets its own reserved worker, so its mailboxes sign in to their providers from an address no other customer, and no other client of yours, uses. One worker per client rather than one for the whole agency keeps a provider's limits on one address from reaching every client at once, and keeps one machine going down from stopping all of them.

• A client is given its worker when its first mailbox connects, not when the workspace is created, so empty workspaces hold nothing back.
• Mailboxes already connected move onto the reserved worker gradually, not all at once, because every move makes the provider see a new sign-in address.
• The reservation is a strong preference, not a pin. If the worker goes down, the client's mailboxes keep sending from elsewhere and move back once a reserved worker is available again. When no worker is free to reserve, SenditCold keeps trying and still places the client away from other customers where it can.
• Up to 20 client workspaces of one agency hold a reserved worker at a time: the 20 that joined the agency first among those with a mailbox. Clients beyond that get every other Agency Pro feature, and SenditCold still places their mailboxes away from other customers where it can, but without a worker of their own. When a client with a reserved worker leaves, the next one in line gets it.
• Moving to Agency, detaching a client, or the plan ending releases the client's worker. Its mailboxes stay where they are until they are moved for another reason.

Switching plans

Owners and admins move between Agency and Agency Pro, or between monthly and annual billing, under Agency > Billing. Each plan shows what the switch would bill before you confirm it. The change is prorated: you pay or are credited the difference for the rest of the billing period on your next invoice, and Stripe bills an interval change right away. Every client workspace has the new plan at once.

Moving to a smaller pool is refused while the current period has already used more sends than that pool and its top-ups hold; switch once the period renews. A plan arranged directly is changed by whoever arranged it, not here.

Top-ups and payment

When the pool runs low, buy a top-up pack under Agency > Billing: 50,000 more sends, $85 on Agency or $60 on Agency Pro. A pack is a one-off payment, added to the current period's pool, and does not carry into the next period. A pack that is fully refunded leaves the pool.

Automatic top-up

Agency > Billing has an automatic top-up for the send pool and another for the shared AI balance. Each is off until you turn it on, and each shows what one top-up charges and the most it can charge in a month before you do.

Each top-up is charged to the card your plan is paid with and has its own invoice, with tax added where it applies. Owners and admins are told each time one happens. One top-up is made at a time and each is charged once, so the limit is never passed. The numbers are saved together with Save changes; nothing you type is acted on before that. If you are already below the new level when you save or turn it on, one top-up is charged right away. Once the month's limit is reached nothing more is charged: campaigns pause when sends run out, and AI features stop when the balance does, until the month renews or you add more yourself.

An agency with no saved card cannot turn either on. The card charged is the one your subscription is paid with, or the default card on your billing account. A plan arranged directly has neither at first: buy a pack or AI balance once at checkout to create the billing account (that purchase does not save its card), then add a card and make it the default under Invoices and payment. If the card is declined, that top-up turns itself off and tells the owners and admins, and its invoice is cancelled so nothing stays owing. Update the card and turn it on again. You can turn either off at any time; a top-up that was already paid for is still added. If a top-up cannot be confirmed with the payment provider for several hours, the owners and admins are told, and no further top-up of that kind is made until it is settled. Turning one on needs a recent confirmation of your identity, because it lets the card be charged with nobody present.

Like every SenditCold checkout, the agency plan, top-up packs and AI balance purchases ask for your company's legal name and billing address, and for its VAT or other business tax ID if it has one. Prices exclude taxes.

Owners and admins manage the plan, top-ups, AI balance purchases, invoices and payment method. Invoices and payment opens the billing portal. If a payment fails, client workspaces keep the plan while Stripe retries; if the subscription ends, they keep it until a few days after the period it paid for, then go back to their own plans.

A plan arranged directly

Agency Scale and other negotiated plans are arranged with SenditCold, or with whoever runs your instance, and not bought at checkout. Agency > Billing then shows the plan as Arranged directly, not billed here, with its end date when it has one, and there is no subscription to manage. Everything else works the same: every client workspace gets the plan, the pool renews each month (on the first, UTC, when the agency has no subscription), and top-up packs and AI balance can still be bought.

Such an agency can also be given a pool and a monthly AI allowance of its own, larger than its plan's, extra sends for the current period, and AI balance that does not expire. Agency > Billing and the usage pages show the totals that apply.

The shared AI balance

AI in SenditCold is paid for from a balance. Each client workspace keeps its own, and the agency has one more, shared by every client:

The included amount is the agency's, not each client's, so opening more workspaces does not add to it. Client workspaces on an agency plan get no monthly allowance of their own.

• Spending order. AI in a client workspace spends that workspace's own balance first. When it runs out, the rest of the charge comes from the agency balance: this period's included amount first, then money the agency bought.
• Renewal. The included amount refills every month on the day the agency's billing period started, on an annual plan too. What is left of it does not carry over. Money the agency bought never expires.
• A cap per client. Give a client an AI cap on the Clients page to hold it to part of the agency balance each period. A cap of $0 keeps the client to its own balance. Select No cap to remove it. The cap counts only what the client spent from the agency balance, net of refunds, and starts over each period.
• Add balance to a client. Add balance in a client's row menu moves an amount, from $1 to $5,000, out of the agency balance into that workspace's own balance, where it stays and does not expire. It is refused when the agency balance holds less. Moving money asks you to confirm it is you, and does not count toward the client's AI cap.
• Buy more. Agency > Billing > AI balance adds money to the agency balance through checkout, dollar for dollar, from $5 to $5,000, while the agency has a plan. A purchase that is fully refunded leaves the balance, except for what was already spent.
• Refunds. When a charge is refunded (a placement test that delivered nothing, for example), the agency's part goes back to the agency balance and the workspace's part to the workspace.

Agency > Usage shows the balance next to the send pool: the included amount and what is left of it, what was bought, what clients spent from it this period, what was moved to clients, and each client's spend against its cap. A client workspace's own billing page counts the agency balance as available, so it is not shown as out of balance while the agency can still pay.

Workspace spend limits and member spend limits in a client workspace count everything it spends, whichever balance paid.

A self-hosted instance does not charge for AI, so there is no agency balance to manage there: AI runs without a balance, and moving or buying balance answers 503 agency_billing_disabled.

The agency balance and its history do not travel in a workspace export. Money already moved into a workspace is part of that workspace's own balance.

Mailboxes across clients

Agency > Mailboxes lists the mailboxes of every client on one screen, newest first: the address, the client it belongs to, its state (connected, disconnected, failing to sign in, or held from warmup), whether warmup is on and its daily limit. Search addresses, filter by client, or select Needs attention to see only the ones that are disconnected, failing or held. Selecting a mailbox opens it in its client's workspace, which is where it is changed.

The list follows your membership in each client, like the agency home: a client where you are restricted to selected mailboxes, or are not a member, is left out. It reads through GET /agency/:agencyId/mailboxes.

Who connects a client's mailboxes

Either of you can. Some clients run their own inboxes; for others you buy and manage them. Add mailboxes asks which client, then how:

Each one opens inside that client's workspace, in the same dialog its own Accounts page uses, so warmup, limits and the mailbox allowance apply exactly as they do there.

Vendor accounts held by the agency

When you buy the mailboxes for your clients, the vendor account is yours, not any one client's. An owner or admin connects it once: Agency > Mailboxes > Connect a vendor, pick the vendor and paste its API key. The key is checked with the vendor, stored encrypted and never shown again. Connecting, re-keying and removing an account each ask you to confirm it is you.

• Add to a client on the account, or the account's own option in Add mailboxes, opens that client's vendor import on it. You pick which mailboxes go to this client; the rest stay at the vendor for your other clients.
• Any staff member who manages mailboxes in the client can use an account. Only owners and admins connect, rename, re-key or remove one.
• It works in the client like any vendor connection. The client's workspace lists the account under its vendor accounts, tagged Agency. Rotated passwords are picked up, Google mailboxes can be signed in again through the vendor, and DNS is written for the domains the account holds, as described under import from an inbox vendor.
• Only your staff see what is in it. The account lists the mailboxes of every client, so a person a client invited to its own workspace sees that the account is there and cannot list or import its mailboxes (agency_vendor_staff_only).
• The key lives in one place. A client's workspace holds no copy of it: the account's key is read each time it is used, and only while the workspace is still your client. Rename or update key therefore takes effect in every client at once. It cannot be changed from inside a client's workspace (agency_vendor_managed).
• Removing it keeps the mailboxes. Removing the account, or removing a client from the agency, ends the use of the account there. The mailboxes it connected stay connected and keep sending; they just stop picking up new passwords from the vendor on their own.
• It does not leave with a client. A workspace export of a client carries the connection without a key, because the workspace never held yours.

The accounts are listed with GET /agency/:agencyId/vendors and connected with POST to the same path, changed and removed with PATCH and DELETE /agency/:agencyId/vendors/:id, and used in a client with PUT /agency/:agencyId/vendors/:id/clients/:orgId. They answer a signed-in session only, never an API key, because they carry keys.

Client connect links

Stop asking clients for their mailbox passwords. In a client's workspace, open Mailboxes and choose Invite client to connect. Pick how the client may connect (Google sign-in, Microsoft sign-in, IMAP and SMTP details, an inbox vendor account, or any of them), how many mailboxes the link connects (up to 500), when it expires (1, 7, 30 or 90 days), the tags each mailbox gets, and whether warmup starts as soon as it connects. A label you give the link is only for your team.

The link is shown once. Copy it and send it to the client; SenditCold keeps only a fingerprint of it, so a lost link cannot be shown again. Revoke it and make a new one instead.

The client needs no SenditCold account. The page shows the workspace's name and brand, and:

• Google or Microsoft: the client signs in with their provider in a separate window and approves SenditCold there. Their password goes only to Google or Microsoft.
• Inbox vendor account: for a client who bought its mailboxes from Zapmail, InboxKit or another supported vendor. The client picks the vendor, pastes the account's API key, passes a security check, and sees the account's mailboxes with the ones already connected marked. It ticks the ones to connect, up to what the link still allows, and they are imported together in the background. The key is sent once and never returned to the page: it is checked with the vendor, held encrypted for up to 15 minutes while the client picks, and then kept as a vendor account of the workspace, named after the vendor with (from a client), so rotated passwords are picked up later. Every mailbox the client picks counts toward the link when the import starts, including one that later fails to connect, and rows that need you are listed under Imports in the workspace.
• IMAP and SMTP: the client picks their mail host from a list (Gmail with an app password, Microsoft 365, Zoho, Yahoo, iCloud, Fastmail, GoDaddy) or enters the servers, passes a security check, and the details are tested against their mail server before anything is saved. The password is stored encrypted and nobody in the workspace can read it.

Each mailbox lands in the workspace exactly as if you connected it, counted against the workspace's mailbox allowance, and in your name: you get a notification each time one connects, and the mailbox list updates for the whole team. When the link reaches its limit the client sees that it is complete; a link that expired or was revoked tells them to ask for a new one, and one whose workspace is full tells them to let you know.

The link opens on your agency's portal domain when it has one, else on the shared portal address (portal.senditcold.com on SenditCold Cloud). The page works on its own and inside an iframe on your website, so you can put it on a client onboarding page. Sent links in the same dialog lists every link with its status, how many mailboxes it connected and which, and Revoke, which stops the link at once and leaves connected mailboxes alone. A link also stops working when the member who made it loses permission to manage mailboxes.

A link is a live way into the workspace, so it does not move with a workspace export; the mailboxes it connected do. See Mailboxes and the connect link endpoints.

Client reports

Stop building reports by hand. In each client workspace, open Reports and save a report over the client's campaigns, campaign folders and mailboxes, with the sections they should see: headline numbers, a daily chart, a campaign table, recent and positive replies, and mailbox health with warmup. Share it with a link that carries your brand, embed it on your own site, or schedule it to email the client every week or month with a View full report button.

The client sees the same numbers your dashboard shows, only for what the report covers, and nothing you left off. Reply snippets stay hidden unless you turn them on. A link expires after 90 days by default, and Revoke turns off the link and every emailed one at once. See client reports.

White-label

Put your agency's brand on everything a client sees. Under Agency > Branding, set a name, logo, accent colour and website once, and every client workspace shows them on its connect links, shared reports, report emails and forms. A client workspace can set its own brand under Settings > Branding, which replaces the agency's as a whole.

• Portal domain: point one subdomain, such as portal.youragency.com, at SenditCold and every client's connect links and reports are built on it instead of the shared portal address. Form links stay on the client's forms domain or the shared forms host. Your clients can also sign in to the full dashboard there, in your brand, with no SenditCold name: see the dashboard on your portal domain. You choose whether they sign in on your domain or on the main address, and either way a session signed in there reaches only your client workspaces: see where clients sign in.
• Portal theme: choose a font, corner style and default appearance, upload a tab icon, shape the sign-in page with a layout, background, image, heading and message, and add your support and legal links. See portal theme.
• Embeds: paste a connect link or a report link into Embed on your website for a script tag or an iframe that resizes to fit on your own site.
• Your brand in the dashboard: your client's own team (members who are not your staff) sees your logo and name in the dashboard instead of SenditCold's, a Managed by line with your agency's name, and none of SenditCold's plan, trial or balance prompts. Your staff keep SenditCold's dashboard with a way back to the agency view, and can see what a client sees with view as client.
• Powered by: Agency shows your logo and colour with a small "Powered by SenditCold" line. Agency Pro and Enterprise can remove it.

See white-label.

Copy campaigns to a client

Build a campaign once and reuse it for every client. Copy to workspace… sits in a campaign's ⋯ menu, on its row and in its header, and in a template's menu on the Templates page. To copy several templates, tick them and use the selection bar. Pick one or more workspaces (up to 10 at a time). When you are agency staff, your client workspaces are grouped under the agency's name.

Each workspace gets a draft:

• What travels: the steps with their branching, every campaign setting, the schedule and sending windows, A/B variants and attachments. Images in the emails are copied into the client's workspace and the copy points at them there. Turn on Also copy templates to send templates along too.
• What stays behind: leads, progress, statistics, activity, sending mailboxes, mailbox tags, folders and the tracking domain. Add leads and mailboxes in the client's workspace before you start the copy.
• Settings to pick again: a step that pointed at something only your workspace has (a tag, segment, pipeline, automation, teammate or form link) loses that setting. The summary lists each one. An AI step loses any action that depended on a cleared setting.

The summary shows the result for each workspace, with a link that switches to that workspace and opens the copy. A workspace that could not be copied into says why, and the others go ahead regardless.

To copy, you need to see the campaign in this workspace, and in each destination you need the Manage campaigns permission with access to the whole workspace. A member restricted to selected campaigns cannot copy anything out of the workspace, so a client never takes your campaigns with them. A copy counts toward the destination's daily limit on new campaigns, and its attachments and images count toward that workspace's storage.

API keys and OAuth tokens each reach a single workspace, so they can only copy within it; copying to another workspace needs a signed-in member of both. See the API for POST /campaigns/:id/copy-to and POST /templates/copy-to. This is not the same as exporting a workspace, which moves everything a workspace owns to another instance.

Agency home and inbox

Agency > Overview shows every client on one screen, with problems first. From inside any client, the agency's name at the left of the header brings you back to it, on a phone as well.

The top of the page has the send pool meter with its projection to the end of the period, totals across your clients, and Needs attention. That list names, per client:

• mailboxes that are disconnected or failing to sign in
• mailboxes quarantined or blocked from warmup
• a bounce rate of 5% or more over the last 7 days, once a client has sent at least 20 emails in that time
• campaigns paused by a sending limit, and campaigns paused until the plan is active
• a client at 90% or more of its monthly cap
• the agency's pool when 10% or less is left, or when it is projected to run out before the period ends

Selecting an item opens the page where it is fixed: it switches to that client's workspace first when the fix lives there.

Each client row shows its share of the pool and its monthly cap, emails sent today, replies waiting (unread conversations from people in its inbox), positive replies in the last 7 days, active campaigns, mailboxes with any disconnected ones and their warmup standing (watch, throttled, quarantined, blocked), the 7-day bounce rate, and its open Advisor findings by severity. Rows with critical problems come first. Selecting a row opens the client's workspace; its menu also opens the client's inbox, analytics and reports, sends a connect link, starts a campaign copy and edits the client's monthly cap.

What a row shows follows your own membership in that client, the same as inside the workspace. Campaign numbers, mailboxes and the bounce rate need View campaigns, replies waiting needs Use unified inbox, and Advisor findings need View analytics. A client where you are restricted to selected campaigns and mailboxes, or where you are not a member, shows its pool use only. Staff are added to every client with access to the whole workspace, so this only differs when a client changed someone's access. The page refreshes on its own: changes in the workspace you are in arrive live, and the rest within a minute or when you come back to the tab.

Agency > Inbox lists conversations from every client whose inbox you can read, newest first, each with the client's name. Filter by client, by Unread, Needs reply (the newest message came from someone else) and Positive (a reply classified positive on a campaign), or search subjects, message text and addresses. Opening a conversation shows it read-only and leaves it unread for the client's team. Reply in the client's name switches to that client's workspace and opens the same conversation in its inbox, where you reply as usual. If you are restricted to selected mailboxes in a client, you see only the conversations in those mailboxes.

Neither page sends, changes or deletes anything, and both read through the API routes GET /agency/:agencyId/overview and GET /agency/:agencyId/inbox.

API

An agency gets API keys that work across all of its clients, so one integration can serve every client without a key per workspace.

Create a key

1. Open Agency > API keys and select Create key. Only the agency's owner and admins see the keys and can create them.
2. Name the key and pick its permissions: Read only, Full access, or Custom to choose each one. Agency permissions cover the agency's own endpoints (its clients, usage and AI balance); client workspace permissions cover what the key can do inside each client, the same as a workspace key.
3. Optionally limit it to IP addresses or ranges.
4. Confirm it is you, then copy the key. It starts with wmagency_ and is shown once; SenditCold keeps only a hash of it.

The key list shows each key's prefix, status and when it was last used. Select a key to rename it or change its IP addresses, and revoke it from there or from its menu. A revoked key stops working on its next request.

Call a client

Send the key as a bearer token and name the client workspace in the Warmbly-Organization header:

curl https://api.senditcold.com/v1/campaigns \
  -H "Authorization: Bearer wmagency_..." \
  -H "Warmbly-Organization: <client workspace id>"

Every request checks that the workspace is still one of your clients before anything else happens, so a client you detach, or one that leaves the agency, is out of reach on the next request. The agency's own endpoints under /v1/agency/<agency id> take no header. Client workspace ids are in GET /v1/agency/<agency id>/clients. See agency API keys for examples in JavaScript, Python and Go, and the endpoint map for which agency endpoints a key can call.

What a key acts as

A key acts for the owner or admin who created it, with their Admin access in each client and never more than the permissions you picked. It stops working when that person stops being an owner or admin of the agency, changes or resets their password, or is banned. Changes made with it show in each client's activity log under that person, marked as made with the key.

What keys cannot do

• Add or change staff, rename the agency, or change its brand or portal domain.
• Start a checkout, buy a top-up or AI balance, or open the billing portal: those open a browser page.
• Create, change or revoke API keys, the agency's or a workspace's, or manage OAuth apps.
• Open the realtime connection or use the MCP server. There are no OAuth apps for agencies yet.

Agency keys belong to the agency, so a workspace archive does not carry them.