How to give an AI agent access without sharing passwords

To give an AI agent access without sharing a password, give it a credential of its own: one that names what it may do, can be capped, and can be revoked without touching anything else. In Space Context you give each agent an API key of its own, with scopes, and every MCP connection and terminal sign-in gets one automatically. Without the opt-in spaces:sensitive scope, the agent reads each space with Wi-Fi passwords, door codes and the narration removed, everywhere: documents, search, answers and exports.

In short

• Four scopes: spaces:read, scans:read, scans:write and spaces:sensitive. The last one is never granted by default.
• A key without spaces:sensitive reads a redacted document. Search never returns a sensitive value, whatever the key.
• Each MCP connection gets its own key: read-only, with no sensitive values, unless you tick otherwise when you connect.
• A live key can have a monthly spending cap. Revocation takes effect at once, and the audit log records who did what.
• A key cannot create keys, see billing or change webhooks, so a leaked key cannot mint a new one.

Why shouldn’t you give an AI agent your password?

A password opens everything the account can do. It cannot be narrowed to one task, and changing it locks out you and every other tool at the same time. The OWASP Top 10 for LLM applications names the result Excessive Agency (LLM06:2025) and gives the remedy: “Limit the permissions that LLM extensions are granted to other systems to the minimum necessary in order to limit the scope of undesirable actions.”

Space Context keeps the two kinds of credential apart. Your sign-in opens the console, where you act as the owner with every permission. A console session cannot be used as an API key, and an API key cannot open the console: keys cannot create keys, see billing or change webhooks. An agent holds a key; you hold the account.

Which scopes can a Space Context API key have?

From the API keys documentation:

A request that needs a missing scope answers 403 INSUFFICIENT_SCOPE. Keys also have a mode. A test key (sc_test_…) sees only the demo space and spaces created with test keys, never your real data. A live key (sc_live_…) sees your real spaces.

The docs put the rule in one line: give an agent the narrowest key that does the job, spaces:read alone for an assistant that only answers questions.

What does an AI agent see without spaces:sensitive?

The demo space (spc_demo, a real apartment in Brisbane) shows it. The demo’s narration, which is invented for the example, says the Wi-Fi network name and password aloud. A key with spaces:sensitive reads this fact (some fields left out here):

{
  "id": "fact_1",
  "kind": "wifi",
  "statement": "The Wi-Fi network is Brisbane flat and the password is recorded separately as a sensitive value.",
  "value": "Brisbane flat / Sunny Balcony 42",
  "sensitive": true,
  "redacted": false
}

A key without the scope reads the same record with the content gone:

{
  "id": "fact_1",
  "kind": "wifi",
  "statement": "Sensitive value recorded. A key with the spaces:sensitive scope can read it.",
  "value": null,
  "sensitive": true,
  "redacted": true
}

Hiding the fact is not enough, because the same words appear elsewhere. The area’s description, written from the narration, reaches the restricted key like this (excerpt):

… The fuse box is in the hallway cupboard behind the coats. The Wi-Fi network is "[redacted]" and the password is "[redacted]." Bins are put out on Tuesday evening, and the yellow bin is for recycling.

The fuse box and the bins are still there to build against. The full set of rules for a redacted document:

• sensitive facts keep their place, with the statement replaced and value set to null;
• the location of keys, and of other sensitive key locations, is hidden;
• the same values are removed from every other text. A value that holds two secrets, like “network / password”, is removed whole and part by part;
• no transcript, no owner answers, no source_quote on how-to steps;
• frames that show sensitive content have no URL.

Search never returns a sensitive value, whatever the key: its index holds only redacted content. Ask answers from the document the key may read, so for a restricted key the model that writes the answer never sees the value either. Agent Skills and Markdown exports are built from the same redacted document.

What about content that has not been screened yet?

A restricted key reads only what the screening pass has read, minus what it marked as sensitive. A space created through the API is screened as part of its scan. A space scanned with the iPhone app is screened the first time the API reads it, usually in a minute or two. Until then a restricted key gets the document’s shape and counts with no content, and ask, Skill and Markdown answer 409 ENRICHMENT_PENDING. Past scans of app spaces are never screened, so they need spaces:sensitive.

Raw sources are refused outright. Asking for the transcript without the scope answers:

{
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "include=transcript requires the spaces:sensitive scope",
    "request_id": "…",
    "required_scopes": ["spaces:read", "spaces:sensitive"]
  }
}

Redaction depends on detection: the deep pass marks sensitive facts, and a rule-based second net catches passwords and codes announced in text, card numbers, IBANs, emails and phone numbers that it missed. Before you hand a restricted key to someone else’s agent, read one of your spaces with it and check what comes back.

Try it on the demo: get a free test key, create one key with spaces:sensitive and one without, and read spc_demo with both.

How do I connect Claude or ChatGPT without giving it my login?

Through the MCP server, which connects to Claude, ChatGPT, Cursor, Claude Code, Codex and VS Code with OAuth. There is no key to paste and no password to share:

1. The assistant opens a Space Context page in your browser, and you sign in there yourself.
2. You choose whether it may also see sensitive values and whether it may scan spaces for you. By default it may do neither.
3. You approve, and Space Context creates an API key for this connection only, named after the assistant and marked MCP in the console.

A default connection is read-only: it cannot change, delete or scan anything, and it cannot spend money. No MCP tool reaches the open web. Allowing scans needs a card on file, and each scan then uses your free scan or is paid from your balance. More on the tools in the MCP server for physical spaces.

How do I give a terminal agent its own key?

npx spacecontext login shows a code in the terminal and sends you to the console. You type the code, read what is asking, choose the key’s mode and scopes, and approve. The terminal receives a key of its own, listed as CLI · … and revocable at any time. The code never travels in a link, and the key reaches the terminal without passing through the browser. Approve only a code you are looking at in your own terminal.

To check what a key can do, npx spacecontext whoami prints the account, the key (masked), its mode and scopes. Over HTTP:

curl https://api.spacecontext.app/v1/me \
  -H "Authorization: Bearer $SPACECONTEXT_API_KEY"

{
  "user": { "id": "…", "email": "you@example.com", "is_pro": false },
  "key": { "id": "key_…", "mode": "test", "scopes": ["spaces:read", "scans:read", "scans:write"] }
}

How do I cap what an AI agent can spend?

Reading, search and answers are included, so only scans cost money ($1.00 per live scan from a prepaid balance). Three controls apply:

• Leave out scans:write. A key without it cannot create or start a scan, and a read-only live key never needs a card.
• Set a monthly cap. A live key can have a cap in US dollars. A scan that would take the key’s spending for the calendar month over it is refused with 402 SPENDING_CAP_REACHED. Other keys are not affected, and the cap counts what that key spends, not your whole balance.
• Use test keys for development and CI. Test scans are free and instant and always return the demo content.

A live key with scans:write needs a card on file. Adding one in the console charges nothing.

How do I revoke an agent’s access and see what it did?

Revoke in the console takes effect at once: the next call with the key answers 401 INVALID_TOKEN. Revoking an MCP key disconnects that assistant, which asks you to sign in again on its next request. Connecting the same assistant again replaces its previous key.

The audit log (console → Security) records every sign-in, key, webhook change, payment, refund and deletion, with who did it: you in the console, an API key, Stripe or Space Context itself. Secrets are never written there, and entries are kept 400 days. The API keys page shows each key’s last use, and the overview shows usage per key.

A least-privilege checklist for AI agents

Least privilege also limits the damage when an agent is fooled by text it reads. A sign in a video that tells an AI to send the door code gets nowhere if the key never had the code; see prompt injection from the physical world.

Start with a test key

Space Context turns a video of a space into a structured, cited Space Document that agents read through the REST API, the SDK (@spacecontext/sdk), the CLI (npx spacecontext) and the MCP server, each with its own scoped key. A test key is free and works on the demo space, with no charge and none of your data involved.

Get a free test key