> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting INKY to Neo

> Create an INKY API key with the permissions your agents need and save it in Neo

You connect INKY once at the MSP level. One API key made at your top-level organization covers every client team beneath it.

## 1. Create the API key

INKY fixes a key's permissions when it is created, and its default role leaves some out. Choose them now; to add one later you create a new key.

<Steps>
  <Step title="Open API Keys">
    Sign in to the INKY console as a super admin of your top-level organization ([app.inkyphishfence.com](https://app.inkyphishfence.com/settings/api-keys), or [app.eu.inkyphishfence.com](https://app.eu.inkyphishfence.com/settings/api-keys) in Europe) and open **Settings > API Keys**.
  </Step>

  <Step title="Choose the permissions">
    Create a customer-issued API key (INKY's term), name it Neo, and give it the permissions for the jobs your agents do:

    | Job | Permissions |
    | - | - |
    | Read INKY's analysis of a message | `messages.read` |
    | Read reported mail | `reported_mail.read` |
    | Confirm, reject, remediate or dismiss a report, and see the allow and block options on a reported message | `reported_mail.execute` |
    | Read, add, change or remove allow-list rules | `allow_list.read`, `allow_list.create`, `allow_list.modify`, `allow_list.delete`; `allow_list.execute` for a rule that allows everything from a sender |
    | Read, add, change or remove block-list rules | `block_list.read`, `block_list.create`, `block_list.modify`, `block_list.delete` |
    | Manage VIPs | `vip_list.read`, `vip_list.create`, `vip_list.modify`, `vip_list.delete` |
    | Manage console admins | `admins.read`, `admins.create`, `admins.modify`, `admins.delete` |
  </Step>

  <Step title="Copy the key">
    Copy the key. INKY shows it only once.
  </Step>
</Steps>

<Warning>
  Do not revoke or rotate the key in INKY after you connect it, and note its expiry date. Neo loses access until you save a new key here.
</Warning>

## 2. Add the key in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open **Integrations** and find the INKY card, under Security.
  </Step>

  <Step title="Save the key">
    Choose the region you sign in to, paste the API key and click **Save settings**. Neo checks it against INKY before saving, so a wrong key or region is rejected straight away. A partner integration key is refused: create a customer-issued API key.
  </Step>
</Steps>

## 3. Turn INKY on per agent

Open the agent, go to the Integrations section, and pick an access profile for the INKY block, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Teams and Usage** | Disabled, Read Only | Your organization nodes and client teams, protected domains and mailbox usage. |
| **Messages and Statistics** | Disabled, Read Only | INKY's analysis record of each inbound message, and daily counts per team. |
| **Reported Mail** | Disabled, Read Only, Read / Write | Reported messages; confirming, rejecting, remediating and dismissing reports. |
| **Allow List** | Disabled, Read Only, Read / Write | Allow-list rules, and applying an option INKY offers on a reported message, which needs Block List too. An allow rule weakens protection. |
| **Block List** | Disabled, Read Only, Read / Write | Block-list rules. |
| **VIPs** | Disabled, Read Only, Read / Write | Each team's VIP list. |
| **Console Admins** | Disabled, Read Only, Read / Write | INKY console roles on each team. |
| **Organization-Wide Changes** | Disabled, Read / Write | Any write to an organization node. INKY applies an allow rule, a block rule or an admin grant written there to every team beneath it. |

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and reported-mail reviews and verdicts | Allow-list and block-list changes. VIP, admin and organization-wide changes are off |
| **IT Admin** | Every read, reported mail, block list and VIPs | Allow-list changes, console admin changes and organization-wide changes |
| **Full Automation** | Every read and write | Nothing |

INKY marks most of its API as beta: those endpoints may change before INKY moves them to a stable version. If an INKY call starts to fail after an INKY update, tell Neo support.

See [INKY API](/agents/tools/security/inky-api) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.