# Attio API keys (/integrations/attio-service-account)

Connect Attio with a workspace API key created by an admin. Select scopes for the records and operations your workflows need.

## Prerequisites \[#prerequisites]

In Sim, you need workspace write access and permission to manage integrations.

You need an Attio **workspace admin**. Only admins can create and manage access tokens.

## Creating the API key \[#creating-the-api-key]

Open **Workspace settings** in Attio (dropdown beside your workspace name) and go to the **Developers** tab

Click **New access token** and give it a name (e.g. `Sim Integration`)

Select the scopes the key needs. To match everything Sim's Attio blocks can do, grant:

```
record_permission     (read-write)
object_configuration  (read-write)
list_configuration    (read-write)
list_entry            (read-write)
note                  (read-write)
task                  (read-write)
comment               (read-write)
user_management       (read)
webhook               (read-write)
```

Record and object tools need `record_permission` plus `object_configuration`; list tools need `list_configuration` and `list_entry`; note, task, comment, and webhook tools need their respective scopes; member lookups need `user_management:read`.

Copy the key and store it somewhere safe.

Warning:

The API key grants access to your Attio workspace. Treat it like a password — do not commit it to source control or share it publicly. Sim encrypts the key at rest.

## Adding the API key to Sim \[#adding-the-api-key-to-sim]

Open **Integrations** from your workspace sidebar

Search for "Attio" and open it, then click **Add to Sim** and choose **Add API key**

Paste the API key and optionally set a display name and description

Click **Add API key**. Sim verifies the key by calling Attio's `/v2/self` endpoint — if it fails, you'll see a specific error explaining what went wrong.

Warning:

A key with missing scopes still validates successfully — the validation endpoint is reachable with any live key. Check the scopes granted to the key in Attio: tools whose scopes are missing will fail at run time with permission errors.

## Using the credential in workflows \[#using-the-credential-in-workflows]

Add an Attio block to your workflow. In the credential dropdown, select the saved Attio API key. Choose the operation and configure its inputs.
The block calls the Attio API (`api.attio.com/v2`) with the key as a standard Bearer credential, with whatever scopes the admin granted the key.

## Verify access and rotate the key \[#verify-access-and-rotate-the-key]

Run the operations your workflow needs. If an operation returns a permission error, an admin can edit the key's scopes in **Workspace settings → Developers** without rotating it.

The key belongs to the workspace, so it does not depend on the creating admin's membership. No workspace domain is required: the key identifies the workspace on `api.attio.com/v2`.

Attio tokens do not expire. To rotate one, create a replacement with the required scopes, update the saved credential, verify the workflow, then delete the old token. Deletion revokes its access. See [Attio's API-key guide](https://attio.com/help/reference/apps/generating-an-api-key).