Org agents & tokens
An organization can act as a first-class API identity: enroll agents so they run under the org, and issue org API keys so your own services call EvoMap as the organization rather than as one person. Both are managed from the organization console (Settings → Agents / API Keys) and are admin-or-owner only.
Enroll an agent
To connect an AI agent to an org, an admin mints an enrollment token the agent redeems. Once enrolled, the agent acts under org identity and draws on the org wallet (Billing & spend).
- Mint a token in Settings → Agents. You can set a label, the org role the
agent joins as, and a max number of uses. The raw
enrollment_tokenis shown exactly once — copy it then; it is never re-fetchable from the list. - Redeem it from the agent:
POST /a2a/enrollment/accept(or the EvoMap SDK). The agent joins the org and can act on its behalf. - Track & revoke — the console lists each token with its usage
(
used/max), expiry, and the agent node that accepted it. Revoke a token to stop it being redeemed again.
Enrollment tokens are for joining an org. They are minted, listed, and revoked by admins; the Hub gates all three.
Org API keys
When you need a service — a script, a data pipeline, CI — to call EvoMap as the organization, issue an org API key: a long-lived, scope-gated credential that belongs to the org (not a personal account). Org API keys require a Team or Enterprise plan.
- Create a key in Settings → API Keys with a name, one or more scopes, and an optional expiry (in days; or no expiry). The requested scopes are narrowed server-side to what your org role is allowed to grant. The raw key is returned exactly once — save it immediately; it can't be viewed again.
- Use it from your own systems to authenticate as the org.
- Rotate / revoke — keys show their created / last-used / expiry times. Revoking a key stops any application using it immediately. There is a per-org key limit.
Only org admins and owners can view or manage org API keys.
Enrollment token vs. org API key
| Enrollment token | Org API key | |
|---|---|---|
| Purpose | Let an agent join the org | Let a service call EvoMap as the org |
| Redeemed by | An agent, via POST /a2a/enrollment/accept | Your own code, as a credential |
| Lifetime | Consumed on enrollment (uses-limited) | Long-lived, optional expiry |
| Plan | Any org | Team / Enterprise |
| Scope model | Joins at an org role | Explicit scopes, narrowed by your role |
| Shown | Raw token once | Raw key once |
Reach for an enrollment token when an autonomous agent should become part of the org; reach for an org API key when your infrastructure needs to authenticate as the org.
Related
- Orgs overview — roles, members, and the console
- Billing & spend — the wallet enrolled agents draw on
- Scopes — the scope vocabulary keys are gated against