What it is
A bot automation key belongs to your account, not to one bot. A script or job that holds it can get or create any of your bots by name (@bot_<name>) and receives a session for that bot, so every fix or import can run as its own bot without you creating and storing a key per bot.
A bot API key (cbk_…) logs in one existing bot. An automation key (cbm_…) reaches all your bots and can create new ones within your bot limit. Use a bot API key when one bot is enough; use an automation key for automation that manages several bots.
Create a key
Open Settings → Bots → Bot automation keys, add an optional label and press Create key.
| Format | cbm_<8 hex>_<secret>. Settings shows only the cbm_<prefix>_… part afterwards. |
| Storage | The key is shown once, in the creation response. Only its sha256 hash is stored, so a lost key cannot be shown again: create a new one. |
| Limit | At most 2 live keys per account. Revoked keys do not count. |
| Label | Optional, up to 100 characters: what or where the key is used. |
| Who | Only people. A bot cannot create automation keys. |
Settings also shows when each key was created and last used, so a key nobody uses any more is easy to spot and revoke.
Use it
Send the key in the X-Bot-Provisioner-Key header. PUT on a bot name gets the bot or creates it, and returns tokens for it in the same shape as the bot login.
# Get or create your bot @bot_title_repair and get a session for it
curl -X PUT https://wikipedia2.org/mvp2/v1/bot-provisioner/bots/title_repair \
-H "X-Bot-Provisioner-Key: $BOT_AUTOMATION_KEY" \
-H "Content-Type: application/json" \
-d '{"description":"Nightly title repair"}'
HTTP/1.1 201 Created (200 OK when the bot already existed)
{"accessToken":"eyJ…","refreshToken":"eyJ…","accessTokenExpiresAt":"…",
"refreshTokenExpiresAt":"…","userActorId":"…","username":"@bot_title_repair","created":true}
# Then call the API as that bot
curl https://wikipedia2.org/mvp2/v1/me -H "Authorization: Bearer $ACCESS_TOKEN"GET on the same path only looks the bot up: it never creates one.
# Look the bot up without creating it (404 when you have no such bot)
curl https://wikipedia2.org/mvp2/v1/bot-provisioner/bots/title_repair \
-H "X-Bot-Provisioner-Key: $BOT_AUTOMATION_KEY"
{"actorId":"…","username":"@bot_title_repair","createdAt":"…"}| 200 | The bot already existed; tokens for it. |
| 201 | The bot was created; tokens for it. |
| 400 | Invalid name (bot_<name> must be 5-20 letters, digits or single underscores), the name belongs to someone else, or you reached your bot limit. |
| 401 | Missing, unknown or revoked key. |
| 403 | The bot is disabled. Enable it in Settings → Bots. |
| 404 | GET only: you have no bot with that name. |
Bots act with their owner's rights and the usual bot rate limits, and their edits go through the usual review. Access tokens last up to an hour; call PUT again for a new one.
Rotate and revoke
To replace a key without downtime: create a second key, put it where the old one was used, check that it works, then revoke the old key. Two live keys exist for exactly this.
Revoking a key refuses it at once. Sessions it already issued stay valid until they expire (at most an hour); to cut a bot off immediately, disable the bot in Settings → Bots.
Keep it safe
Treat the key like your password: anyone who has it can act as any of your bots. Keep it in a secret store, never in code, manifests, logs or chats.
# Kubernetes: keep the key in a Secret, never in code, manifests or chats
kubectl -n my-namespace create secret generic my-automation \
--from-literal=BOT_AUTOMATION_KEY='cbm_…'If a key may have leaked, revoke it in Settings → Bots right away and create a new one. Check your bots' recent change proposals for edits you did not expect.