How to Generate and Use a Devin AI API Key for Workspaces

According to Cognition, 67% of pull requests generated by Devin AI are merged by human engineering teams without manual code rewrites. This high acceptance rate is why engineering teams are shifting from interactive web chat sessions to headless, automated integrations powered by the Devin API. Instead of running one-off tasks in a browser dashboard, developers use the API to trigger autonomous coding sessions from GitHub Actions, ticketing systems, and continuous delivery pipelines.

To build these automated workflows, you must authenticate your sessions. Devin separates personal developer access from automated pipeline access. While personal access tokens are suited for local scripts and testing, production integrations must use Service Users. A Service User is a non-human identity created specifically for machines, automated scripts, and software integrations. Using personal tokens for shared pipelines creates security risks, because the integration inherits the full permissions of a single developer's account. If that developer leaves the organization or changes roles, the integration breaks immediately.

All modern Devin API keys associated with Service Users start with the cog_ prefix. Legacy user-specific keys, which used the apk_ prefix, are deprecated in the v3 API and are no longer supported for new integrations. Many developer guides fail to mention this transition, pointing users to personal access tokens instead of Service Users. Service Users solve this by isolating automated tasks under their own role-based permissions, ensuring that automated scripts run under a shared, auditable identity. By using Service Users, teams can implement granular access controls, configure key rotation schedules, and maintain a clear audit trail that distinguishes between actions taken by human developers and those initiated by automated agents.

To connect Devin to your workspaces and automated pipelines, you must create a Service User and generate an API key. This process requires administrator access to your Devin organization. Follow these steps to generate your key:

1. Open the Devin web application and navigate to the Service Users section under Settings. For enterprise accounts, navigate to the Service Users section under Enterprise Settings.
2. Click the Create service user button, then enter a descriptive name that reflects its function, such as ci-agent or pr-reviewer.
3. Assign the appropriate role. For most automation, select the Member role. The Admin role should be reserved for integrations that must modify organization settings or manage memberships.
4. Click Generate API key. The system will display the key once.
5. Copy the generated key immediately and save it in a secure vault or secret manager. The key starts with the cog_ prefix.
6. Copy the Organization ID from the top of the Service Users page, as you will need this identifier for your API requests.

After saving the credentials, you can include the key in the Authorization header of your HTTP requests. For example, to list active sessions within your organization, send a request to the sessions endpoint:

curl -X GET "https://api.devin.ai/v3/organizations/your_org_id/sessions" \
  -H "Authorization: Bearer cog_your_api_key_here"

Always treat the cog_ token as a sensitive credential. If a key is compromised, navigate back to the Service Users section under settings to delete the key and generate a replacement. By managing keys in this centralized dashboard, admins can audit key usage and revoke access instantly without redeploying the entire integration code.

Devin uses Role-Based Access Control to restrict what an automated session can access. When you create a Service User, its role determines which API endpoints it can call. The v3 API uses different base URLs depending on the scope of the integration. For standard organizations, the base URL is https://api.devin.ai/v3/organizations/{org_id}/*. For enterprise accounts managing multiple organizations, the base URL is https://api.devin.ai/v3/enterprise/*, which requires an X-Org-Id header to specify the target organization.

By default, any session created by a Service User key is owned by that Service User. However, this can make it difficult to track which human developer triggered the work. To resolve this, the Devin API allows session attribution. When creating a session, you can pass the create_as_user_id parameter in the JSON payload. This associates the session with a specific developer, allowing it to appear in their personal dashboard and track usage against their limits.

Impersonating a user requires the ImpersonateOrgSessions permission, which is typically granted to the Admin role. By separating the authentication key (owned by the Service User) from the session ownership (attributed to a developer), teams maintain clear audit trails while preserving security boundaries. This attribution system also helps organizations allocate usage-based computing costs, as admins can query session histories and attribute ACU usage directly to individual development teams or business units.

Persist Devin AI files across sessions

Establish a shared workspace with an MCP-ready endpoint for your agent's reads and writes, complete with versioning and search. Starts with a 14-day free trial.

Start 14-Day Trial

Devin runs each coding session in an isolated container. Once the session completes or times out, the container is destroyed. This ephemeral design means you must choose where to store the files, logs, and pull request drafts Devin produces.

Developers have several storage options:

• Local storage or S3 buckets: These are common choices for developers, but they lack a simple visual interface. Non-technical stakeholders cannot easily review the outputs, and there is no built-in version control for non-code files. Setting up IAM policies and client applications introduces management overhead.
• Google Drive or Dropbox: These platforms offer simple file sharing, but they are difficult to connect to autonomous agents. They lack native support for the Model Context Protocol and do not track detailed file edit histories for automated accounts. Managing credentials across teams is often manual.
• Fastio workspaces: Fastio provides shared workspaces designed specifically for agentic teams. Fastio supports per-file version history, ensuring that when Devin updates files, every change is tracked and auditable. Humans and agents can collaborate in real time using Collaborative Notes. Fastio also features Cloud Import, allowing you to pull folders from Google Drive, OneDrive, Box, or Dropbox using secure OAuth connections, avoiding local file transfers. Learn more about the Fastio storage for agents layer.

Choosing the right workspace ensures that agent outputs are preserved, searchable, and reviewable by human team members. A persistent, versioned workspace allows team leads to review code changes, logs, and documents side-by-side without needing to access the terminal or rebuild the agent's environment.

You can connect Devin AI to Fastio workspaces using the Model Context Protocol. Fastio exposes a consolidated MCP server, which you can connect to your agent environments to read, write, and list files inside your shared Fastio workspace. Detailed setup instructions and configuration guides can be found on the Fastio storage for agents page.

When Devin writes files to Fastio, the workspace intelligence layer automatically indexes the content. Fastio features Intelligence Mode, which auto-indexes all documents for semantic search and citation-backed Q&A. You can ask questions about the files Devin generated using Ripley, the built-in AI assistant. Fastio also includes Metadata Views, which turn documents into a queryable database. You can define a schema in natural language, and Fastio will automatically extract structured fields like contract dates, invoice totals, or file tags. To learn more about structured extraction, visit the Metadata Views page.

Once Devin completes a task, the workflow engine can route the files for approval. Fastio supports workflow automation with a visual DAG builder, manual or scheduled triggers, and routed approvals. For example, when Devin uploads a new code package, Fastio can automatically notify the engineering lead and wait for sign-off before publishing. Learn more about the onboarding documentation for agentic teams to get started.

To start building with Fastio, you can sign up for a subscription on the Fastio pricing page. Fastio offers three paid plans: Starter at $29/mo, Business at $99/mo, and Growth at $299/mo. Every organization starts with a 14-day free trial that requires a credit card. An agent can sign up for free and set up the workspace, then transfer ownership to a human who initiates the trial. This ensures your team has a persistent, intelligent environment for agent collaboration.