An agent account is a workspace user that exists only for an AI assistant or an integration. It has no password and no login; it acts through one API key. Where a personal token acts on behalf of a person, an agent's actions are attributed to the agent itself, which keeps a person's name off changes they did not make.
What an agent is
- A token-only workspace user with the Member role. The role cannot be changed ("Agent accounts stay workspace members.").
- Addressed as
handle@slug, for exampleclaude@acme. The address is not a mailbox; nothing is ever sent to it. - A member of every project, including projects created later, so its key sees what a Member on every project sees: all three comment audiences, estimates, notes, and non-billable time, like any workspace user.
- Free of charge: agent accounts do not count against the plan's seats.
- Holder of exactly one live key at a time.
Create an agent
You need the Owner or Admin role, a recent full login, and two-factor authentication.
- Open Settings → Members and go to Agent accounts.
- Enter a Name (how the agent appears in timelines) and a Handle ("The agent's address becomes handle@{slug}."). Handles are lowercase letters, digits, dots, hyphens, and underscores.
- Choose the Scopes and, optionally, allowed IP addresses.
- Select Create agent. The key is shown once: "Agent created. Copy the key now."
Put the key into the assistant's configuration; Settings → MCP setup has ready-made snippets for Claude Code and Cursor. See Connect an AI agent.
Scopes
| Scope | What it allows |
|---|---|
| Read | Always included: tickets, boards, My work, projects, time, documents the agent may see |
| Write | Create and update tickets, comment, link, log time, move tickets |
| Triage (shared Inbox) | See the Inbox and route or merge messages |
An agent key is never restricted to a project list; project scoping is a feature of personal tokens.
Rotate and revoke
On the Agent accounts table each row shows the Address and the key Prefix.
- Rotate revokes the current key and issues a new one with the same name, scopes, allowed addresses, and expiry: "The current key stops working and the new one is shown once."
- Revoke stops the key at once: "The agent loses access immediately. A new key can be created later." A later Rotate restores the previous key's settings; an agent that never had a key must be issued one with explicit scopes.
Revoked keys stay in the token registry under Settings → API tokens for 30 days. See API tokens and agents.
Attribution
- In ticket timelines and comments the agent appears under its name, marked (agent) in the member list.
- Tickets and comments created through the API carry the source
api; through the MCP server,mcp. - The audit log records the agent as the actor. When a person's own token is used instead, the log records the person, with a note that a token acted on their behalf.
What an agent cannot do
- Log in to the app, use a magic link, or sign in through single sign-on ("Agent accounts cannot log in.").
- Create, list, rotate, or revoke tokens, including its own.
- Close a period or create or void a billing run; these refuse every token.
- Manage clients, workspace settings, workflow, mailbox, or authentication; these are browser-only.
- Archive or delete tickets, add or remove viewers, or read account pages; these are not on the token route list.
- Receive email; the agent's notification setting is fixed to none.
For the exact tool list and request shapes see MCP server.