Authentication and scopes
Tokens, the five scopes, and what each scope allows.
Every call carries a bearer token. Send it as Authorization: Bearer <token>. What a token can do is set by its scopes.
The five scopes
| Scope | What it allows |
|---|---|
| Read | Read meetings, transcripts, summaries, config, jobs, devices, models, and whoami. |
| Record | Start, stop, pause, and resume recording. Record also grants Read. |
| Write | Create and change data: rename, set summary, submit and manage jobs, manage webhooks, set config. |
| Delete | Delete a meeting. Nothing else is deletable over the API. |
| Admin | Everything, including listing and revoking pairings. |
Admin satisfies every scope. Any of Read, Record, or Write satisfies a Read requirement. Record, Write, and Delete are independent of each other: a Write-only token cannot record, and cannot delete. Delete is satisfied only by Delete or Admin.
Tokens
The token is an opaque random string. Keep it secret.
On the same machine, Meetily writes a loopback token to a private file at {app data}/pro.meetily.ai/gateway-token (permissions 0600). The CLI and SDK read it automatically. This loopback token holds read, record, write, and admin (Admin also satisfies delete), and it does not expire.
For a scoped, least-privilege connection, for example an AI assistant, enable it from the in-app Integrations panel, which mints a per-client token with a read + record baseline (optionally write or delete, never admin).
The CLI's meetily-pro mcp install mints the same kind of scoped, per-client token, by calling a loopback-only endpoint, POST /v1/mcp/client-token (requires Admin scope, returns the raw token once, body {client_name, write?}). It never writes the loopback admin token itself into your client config.
A token issued to a paired LAN client expires 90 days after it is minted. The loopback token and MCP tokens do not auto-expire.
Check any token with GET /v1/whoami - it returns its scopes and the license tier.
The CLI quick-start is least privilege
Running meetily-pro mcp install mints a scoped, per-client token (Read plus Record by default; add --write for write access) rather than handing the client the admin token. The in-app Integrations panel is an alternative path that can additionally grant Delete. See the limitations page.
Check your token
curl -s http://127.0.0.1:8420/v1/whoami -H "Authorization: Bearer $MEETILY_PRO_TOKEN"meetily-pro whoamifrom meetily_agent import MeetilyClient
print(MeetilyClient().system.whoami())Last updated on