Rights to create keys and apps

Rights to create keys, apps and webhooks are set in two places — in the Vibecode dashboard and in Bitrix24. This page explains which setting lives where and how the text of a refusal tells you which one to change.

Two groups of settings

The checks run in sequence. Vibecode rights come first: if they deny the action, the refusal arrives before Bitrix24 is contacted. Bitrix24 rights come next, when a webhook is issued for the key.

Telling the two refusals apart

A Vibecode refusal only points you to your Bitrix24 account administrator and names no Bitrix24 right or setting. Creating a key, for example, returns "You don't have permission to create API keys. Contact your Bitrix24 account administrator." The codes are KEY_CREATION_RESTRICTED for a key and APP_CREATION_RESTRICTED for an app, both with status 403.

A Bitrix24 refusal names the right to create webhooks or to install apps. For example: "Your Bitrix24 account administrator hasn't granted you the right to create incoming webhooks. Ask your administrator to set up the Vibecode Connector and allow incoming webhook creation in the Security section of the Bitrix24 account settings — then you can issue the key." The codes are CONNECTOR_KEY_ISSUE_FORBIDDEN, CONNECTOR_APP_INSTALL_FORBIDDEN and B24_ACCESS_DENIED, all with status 403.

If the refusal came from Vibecode — codes KEY_CREATION_RESTRICTED and APP_CREATION_RESTRICTED — and you are not an administrator, send an access request from the dashboard. The administrator approves or declines it. The request is available when the setting uses the list mode.

The full list of codes is in Errors.

Settings in the Vibecode dashboard

The section is available to the Bitrix24 account administrator.

1. Sign in to the Vibecode dashboard as a Bitrix24 account administrator.
2. Go to the Settings section.
3. Find the setting you need: the right to create keys is in the "Keys" card, the rest are in the "Creation Rules" card.
4. Choose a mode. In list mode, add the employees who are granted access.
5. Click "Save" in the same card.

Each setting has four modes: all users, administrators only, administrators and employees from a list, nobody. Keys and servers have a fifth one, "Inherit": the same rule that is set for apps, agents or bots applies.

In list mode, an employee who is not on the list can send an access request. The administrator approves or declines it.

The "Keys" card also sets the access mode for new keys — read-only, or read and write. It is saved the moment you switch it, needs no separate button, and does not affect keys already issued.

Settings in Bitrix24

The section is available to employees with Bitrix24 account administrator rights.

1. In Bitrix24, open the left menu, click "Settings" and choose "Bitrix24 settings".
2. In the list of sections on the left, choose "Security".
3. Expand the "Bitrix24 integrations" block.
4. In the field you need, click "+ Add" and choose employees.

The "Permission source — Vibecode server" toggle

It sits in the same place, on the Security tab, in the "Vibecode connector" block. The toggle decides whether Bitrix24 applies its own lists when keys are issued and apps are installed through Vibecode.

1. Open Settings → Security in Bitrix24.
2. Expand the "Vibecode connector" block.
3. Set the "Permission source — Vibecode server" toggle to the position you need.

Important: the toggle removes the check on the Bitrix24 side, but the rights set in the Vibecode dashboard apply in either position. If creation is restricted in the Vibecode dashboard, turning the toggle on will not grant access — the refusal arrives before the platform contacts Bitrix24.

The key exists, but calls do not go through

Rights restrict more than key creation. Two cases where the key is issued and visible in the list, yet calls are rejected.

Calls to Bitrix24 answer `401 TOKEN_MISSING`

No webhook has been issued for the key. The cause arrives in the details.reason field:

{
  "success": false,
  "error": {
    "code": "TOKEN_MISSING",
    "message": "This key has no Bitrix24 webhook: the portal refused to create one for its owner. ...",
    "details": {
      "reason": "WEBHOOK_MINT_REFUSED_BY_PORTAL"
    }
  }
}

The value WEBHOOK_MINT_REFUSED_BY_PORTAL means that Bitrix24 denied the key owner the right to create incoming webhooks. Once the administrator grants that right, the platform issues the webhook within 15 minutes. There is no need to reconnect the key or issue a new one: a new key gets the same refusal.

The other details.reason values and what to do about each are in the TOKEN_MISSING section.

Modifying calls answer `403 WRITE_BLOCKED_READONLY_KEY`

The key was issued in read-only mode. The mode is set in the Vibecode dashboard, in the "Keys" card, and applies when the key is issued: it does not carry over to keys already issued. Such a key can read data but rejects modifying calls. An administrator can enable writes for an individual key from its card.

See also

• Keys and authorization
• Authorization, keys and permissions
• Create an app
• Quickstart