# Rights to create keys and apps

Rights to create keys, apps and webhooks are set in two places — in the Vibecode dashboard and in Bitrix24. This page explains which setting lives where and how the text of a refusal tells you which one to change.

## Two groups of settings

| Where | What it sets | Who changes it |
|---|---|---|
| Vibecode dashboard, Settings section | Who creates keys, apps, servers, bots and agents | Bitrix24 account administrator, in the Vibecode dashboard |
| Bitrix24, Settings → Security | Who creates incoming webhooks and apps in Bitrix24 itself | Bitrix24 account administrator |

The checks run in sequence. Vibecode rights come first: if they deny the action, the refusal arrives before Bitrix24 is contacted. Bitrix24 rights come next, when a webhook is issued for the key.

## Telling the two refusals apart

A Vibecode refusal only points you to your Bitrix24 account administrator and names no Bitrix24 right or setting. Creating a key, for example, returns "You don't have permission to create API keys. Contact your Bitrix24 account administrator." The codes are `KEY_CREATION_RESTRICTED` for a key and `APP_CREATION_RESTRICTED` for an app, both with status `403`.

A Bitrix24 refusal names the right to create webhooks or to install apps. For example: "Your Bitrix24 account administrator hasn't granted you the right to create incoming webhooks. Ask your administrator to set up the Vibecode Connector and allow incoming webhook creation in the Security section of the Bitrix24 account settings — then you can issue the key." The codes are `CONNECTOR_KEY_ISSUE_FORBIDDEN`, `CONNECTOR_APP_INSTALL_FORBIDDEN` and `B24_ACCESS_DENIED`, all with status `403`.

| Code | Who refused | What to change |
|---|---|---|
| `KEY_CREATION_RESTRICTED` | Vibecode | "Key creation" in the Vibecode dashboard |
| `APP_CREATION_RESTRICTED` | Vibecode | "App creation" in the Vibecode dashboard |
| `CONNECTOR_KEY_ISSUE_FORBIDDEN` | Bitrix24 | "Who can create incoming webhooks" in the Bitrix24 settings |
| `CONNECTOR_APP_INSTALL_FORBIDDEN` | Bitrix24 | "Who can create apps for everyone" or "Who can create their own apps" in the Bitrix24 settings |
| `B24_ACCESS_DENIED` | Bitrix24 | Bitrix24 denied access without giving a reason. Check three conditions: the key owner has Bitrix24 account administrator rights, the REST module is enabled, the plan does not restrict API access |

If the refusal came from Vibecode — codes `KEY_CREATION_RESTRICTED` and `APP_CREATION_RESTRICTED` — and you are not an administrator, send an access request from the dashboard. The administrator approves or declines it. The request is available when the setting uses the list mode.

The full list of codes is in [Errors](./errors.md).

## Settings in the Vibecode dashboard

The section is available to the Bitrix24 account administrator.

1. Sign in to the Vibecode dashboard as a Bitrix24 account administrator.
2. Go to the Settings section.
3. Find the setting you need: the right to create keys is in the "Keys" card, the rest are in the "Creation Rules" card.
4. Choose a mode. In list mode, add the employees who are granted access.
5. Click "Save" in the same card.

| Setting | What it restricts |
|---|---|
| "Key creation" | Manual creation of API keys. Keys for apps, agents and bots are created automatically and are not covered by this rule |
| "App creation" | Creation of apps |
| "Server creation" | Creation of cloud servers |
| "Bot creation" | Creation of chat bots |
| "Agent creation" | Creation of AI agents |

Each setting has four modes: all users, administrators only, administrators and employees from a list, nobody. Keys and servers have a fifth one, "Inherit": the same rule that is set for apps, agents or bots applies.

In list mode, an employee who is not on the list can send an access request. The administrator approves or declines it.

The "Keys" card also sets the access mode for new keys — read-only, or read and write. It is saved the moment you switch it, needs no separate button, and does not affect keys already issued.

## Settings in Bitrix24

The section is available to employees with Bitrix24 account administrator rights.

1. In Bitrix24, open the left menu, click "Settings" and choose "Bitrix24 settings".
2. In the list of sections on the left, choose "Security".
3. Expand the "Bitrix24 integrations" block.
4. In the field you need, click "+ Add" and choose employees.

| Field | What it restricts |
|---|---|
| "Who can create incoming webhooks" | Issuing a Vibecode key: a key works through a Bitrix24 incoming webhook |
| "Who can create apps for everyone" | Creating an app available to all employees |
| "Who can create their own apps" | Creating an app for yourself |

## The "Permission source — Vibecode server" toggle

It sits in the same place, on the Security tab, in the "Vibecode connector" block. The toggle decides whether Bitrix24 applies its own lists when keys are issued and apps are installed through Vibecode.

1. Open Settings → Security in Bitrix24.
2. Expand the "Vibecode connector" block.
3. Set the "Permission source — Vibecode server" toggle to the position you need.

| Position | What happens |
|---|---|
| On | Bitrix24 does not check its own lists. Rights to create keys and apps are taken from the Vibecode dashboard |
| Off | Bitrix24 additionally checks the fields of the "Bitrix24 integrations" block. An employee outside the list gets `CONNECTOR_KEY_ISSUE_FORBIDDEN` or `CONNECTOR_APP_INSTALL_FORBIDDEN` |

**Important:** the toggle removes the check on the Bitrix24 side, but the rights set in the Vibecode dashboard apply in either position. If creation is restricted in the Vibecode dashboard, turning the toggle on will not grant access — the refusal arrives before the platform contacts Bitrix24.

## The key exists, but calls do not go through

Rights restrict more than key creation. Two cases where the key is issued and visible in the list, yet calls are rejected.

### Calls to Bitrix24 answer `401 TOKEN_MISSING`

No webhook has been issued for the key. The cause arrives in the `details.reason` field:

```json
{
  "success": false,
  "error": {
    "code": "TOKEN_MISSING",
    "message": "This key has no Bitrix24 webhook: the portal refused to create one for its owner. ...",
    "details": {
      "reason": "WEBHOOK_MINT_REFUSED_BY_PORTAL"
    }
  }
}
```

The value `WEBHOOK_MINT_REFUSED_BY_PORTAL` means that Bitrix24 denied the key owner the right to create incoming webhooks. Once the administrator grants that right, the platform issues the webhook within 15 minutes. There is no need to reconnect the key or issue a new one: a new key gets the same refusal.

The other `details.reason` values and what to do about each are in the [`TOKEN_MISSING`](./errors/auth.md#token_missing-401) section.

### Modifying calls answer `403 WRITE_BLOCKED_READONLY_KEY`

The key was issued in read-only mode. The mode is set in the Vibecode dashboard, in the "Keys" card, and applies when the key is issued: it does not carry over to keys already issued. Such a key can read data but rejects modifying calls. An administrator can enable writes for an individual key from its card.

## See also

- [Keys and authorization](./keys-auth.md)
- [Authorization, keys and permissions](./errors/auth.md)
- [Create an app](./apps/create.md)
- [Quickstart](./quickstart.md)