Create a key per agent with a preset, allowed and denied tables, a row limit, a timeout and the statements that need approval.
#Presets
| Preset | Can | Cannot | Connections |
|---|
| Read-only | SELECT on the allowed tables | Write anything | API, MCP, direct |
| App developer | Read and write rows of the allowed tables | Change the schema; writes without WHERE and big changes wait for approval | API, MCP, direct |
| Migrations | Change the schema (acts with the project owner's rights) | Drops, column removals, policy, privilege and extension changes run only after approval | API and MCP only |
#Settings
| Setting | Meaning |
|---|
| Allowed tables | schema.table or schema.*, default public.*. The key's Postgres role gets grants only on these. |
| Denied tables | Never readable or writable, even if allowed by a pattern. |
| Max rows per statement | A statement that changes more rows is rolled back, then refused or sent for approval. |
| Statement timeout | Per statement, also set on the Postgres role. |
| Needs approval | Which risky statements wait for a person instead of being refused (see Approvals). |
| Call your own functions | Off by default. SECURITY DEFINER functions must also be listed by name. |
| Direct connection | A Postgres connection string for the key's role (read-only and app developer presets). |
| Bypass Row Level Security | Off: only rows your policies allow (TO public or for the agent's role). On: all rows of the allowed tables. |
#Manage keys with the API
# Create (owner / admin, or an organization token with projects:write)
curl -X POST https://stitchdb.com/platform/v1/projects/<ref>/agent-keys \
-H "Authorization: Bearer <access token>" -H "Content-Type: application/json" \
-d '{"name": "support-bot", "preset": "app-dev",
"policy": {"tables": {"allow": ["public.*"], "deny": ["public.payments"]}, "max_rows": 100}}'
GET /platform/v1/projects/<ref>/agent-keys
PATCH /platform/v1/projects/<ref>/agent-keys/<id> {"policy": {...}, "name": "..."}
DELETE /platform/v1/projects/<ref>/agent-keys/<id>
| Limit | Free | Pro | Scale | Enterprise |
|---|
| Agent keys per project | 1 | 25 | 100 | 100 |