Why use it
- Your model, your subscription. Therius runs no model on this path. Bring the AI you already pay for.
- Real tools, not a sandbox demo. The agent calls the same analytics, routing, dispute, reconciliation, and integration tools that back Thera.
- Scoped to you. An AI key can never see more than the user who created it. Its capabilities are a subset of that user’s permissions, re-checked live on every call.
- Environment-safe. A key is bound to production or sandbox by its prefix and cannot cross over.
- Works today. No operator setup step — create a key in the dashboard and connect.
- Audited. Every call an AI key makes is recorded.
- Integration acceleration. The
docs:readtools let an AI coding agent look up endpoint schemas, provider capabilities, error codes, and test cards while it writes your integration.
Create an AI key
In the Therius dashboard, go to Developers → AI keys:1
New AI key
Click New AI key. Give it a label and choose the environment (production or sandbox).
2
Grant capabilities
Select the capability groups the key may use. You can only grant capabilities your own role allows — see the table below.
3
Copy the key
The full key (
ai_live_… or ai_sandbox_…) is shown once and cannot be recovered afterward. Store it in a secret manager.analytics:read, docs:read) if you grant nothing. A client administrator can also issue keys to other users within the same client. Revoke a key at any time from the same page — revocation is immediate.
Each key has a request-rate limit (120 requests/minute by default).
Connect an MCP client
The MCP endpoint and REST base URL are shown on the Developers → AI keys page. Copy them from there. The examples below usehttps://ai.therius.io.
https://ai.therius.io/openapi.json and authenticate with the same key as a Bearer token.
Use the REST tool surface
If you’re not using MCP, the same tools are available over plain REST:
Authenticate every request with
Authorization: Bearer <your-ai-key>.
Capabilities
A key carries one or more capabilities. Each maps to the dashboard permission the equivalent action needs — you can only grant a capability if your own role has that permission, and the key’s effective set is narrowed live if your role changes.Scope and safety
- User-scoped. The key acts as the user who created it. It reaches that user’s assigned merchants only — never the whole platform, unless the user is a platform administrator.
- Capability ceiling. A key’s capabilities can only ever narrow the user’s permissions. An over-grant is rejected at creation; a later role change re-narrows the key on the next request.
- Environment-bound.
ai_live_keys reach production data;ai_sandbox_keys reach sandbox data. There is no cross-over. - No card data or secrets. PANs, CVVs, and connection credentials are masked at the tool layer and never returned.
- Audited. Every tool call — tool name, masked arguments, caller, timestamp — is written to the audit log.

