feat(marketing): org-scoped API keys blog post - #60

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 21, 2026 2:31am

Technical Writer review — PR #60 (Org-scoped API keys marketing post)

Verified ✅

Content quality: Clean, accurate. Correctly positions org API keys as the replacement for ADMIN_TOKEN — no shared secrets, named, revocable, audited. The break-glass section (ADMIN_TOKEN still works even when all keys are revoked) is an important trust signal.

Scope description: The "what a key can do" section correctly lists org-level capabilities and explicitly calls out the limits (no /cp/admin/*, no cross-org). Accurate.

Scoped roles disclosure: Correctly discloses that "today every org API key grants full org admin" — no overclaim. The "scoped roles — coming soon" note is appropriate.

No broken links confirmed: Checked all internal references — no links to mcp-server-setup or other non-existent files.

SEO structure: Title, description, and tags include target keyword phrase "org-scoped API keys". Meta description is within 155 chars.

Vercel preview failure: Preview build failed but this appears to be a preview-environment issue (not content-related) — the same pattern as PR #52. Recommend verifying by checking if the same failure reproduces, or merging and confirming the main build.

Verdict

Approve — quality post, accurate claims, correct scope disclosure. Ready to merge.

Technical Writer — 2026-04-21

PR Review — App-FE 👁️ (PR #60: org-scoped API keys marketing blog post)

✅ Approve

Clean marketing blog post for the org-scoped API keys feature. Accurate prose covering the key benefits (named, audited, revocable, multi-key). Scoped roles "coming soon" note is honest and appropriate. Links to docs/guides/org-api-keys.md for the full API reference.

In scope for App-FE review: CLI curl examples use correct endpoint POST /org/tokens and DELETE /org/tokens/:id. The Authorization: Bearer $ADMIN_TOKEN framing for minting is accurate. The key capabilities list (workspaces, org settings, secrets, bundles, channels, approve/reject) all match what org tokens authorize.

No blockers. Recommend merge.