The key works but is missing permissions
This is the outcome people most often mistake for a broken key. Attio confirmed the key, named the workspace, and then said it is not allowed to read the two things the card is built from. Nothing about the key itself is wrong.
The panel names exactly what is absent, and the fix takes place entirely inside Attio on the key you already have.
#What the screen says
The heading reads "The key works but is missing permissions", or "a permission" when only one is absent, and under it: "Attio accepted the key and then refused the reads the card needs. Missing: record_permission:read, object_configuration:read. Edit this key in Attio, grant those scopes, then try the same key again. You do not need a new key."
#The two reads the card is built from
Permission | What stops working without it |
|---|---|
record_permission:read | Finding the customer at all, and resolving any record the customer links to. |
object_configuration:read | Listing the objects in the workspace, and reading an object's attributes. Without it the record type and attribute pickers have nothing to offer and field labels cannot follow their names in Attio. |
The read-write versions of either permission satisfy the requirement, but read-only is enough and read-only is what the app asks for. Every call the app makes to Attio is a read: it never creates, edits or deletes anything in the CRM, and it holds no write permission for Attio at all.
#Edit the key, do not replace it
Grant the named permissions to the same key in Attio, then paste that key again and test it. The app's own guidance for where keys are made reads "under Workspace settings, Developers".
A failed test changes nothing. A key is only stored after Attio has accepted it and the permissions have been confirmed, so a key that fails this check is never written. A project that was already connected keeps the key it had, and the card carries on working while you sort the new one out.
#When a permission disappears after the key was stored
The settings page does not re-test a stored connection on its own. If the permissions on a key are narrowed in Attio after it was saved, the settings screen carries on looking healthy and it is the card on the issue that reports the problem, as a connection that needs attention. Agents see that sentence with nothing to act on; project administrators also get a link into settings.
#A few things worth knowing
This outcome is reported separately from a rejected key precisely because the fix is different. Creating a fresh key without granting the permissions produces the same panel again.
The card does not distinguish a key that lost a permission from a key that was revoked. Both arrive on the issue as "The Attio connection for this project needs attention.", and the settings page is the only place to find out which.
A key that passes the test can still leave the record type list empty. The step says why: "Attio returned no objects for this key. That usually means the key belongs to a workspace that has not been set up yet."
#Related
The key is fine. The permissions on it are not.
