Settings is the account-wide configuration screen. It holds what applies to the whole organization, not to one product: how people sign in, which credentials FirstByte uses to reach other services, and what every console looks like. Per-product configuration does not live here. A trunk belongs to Voice, an app key belongs to Realtime, and each console keeps its own. Settings holds only what crosses products. The screen has six tabs. Telephony tools are managed in the Voice AI console under Telephony tools.

​
Account & Security

Four surfaces, all about how a person proves who they are.
  • Security — multi-factor authentication for your own account.
  • Password — change it. This is the only place the portal writes one.
  • Connected accounts — the social identities linked to your account, if your deployment enables them.
  • SSO — single sign-on for the organization. Once SSO is enforced, members sign in through your identity provider instead of a password.
MFA and password apply to YOU. SSO applies to the ORGANIZATION. Changing SSO changes how every member signs in, so it is an administrator action.

​
API Keys

The tab holds the organization’s MCP access keys. An MCP access key (mpk_) lets a coding agent or an MCP client call the platform’s MCP server (POST /mcp) as you. See MCP.
  • Only an owner or an admin can mint or revoke a key. Every member can see the list. The list shows a preview of each key, not the full value.
  • When you mint a key, you give it a name and you pick its scopes in the scope grid: one row per domain, one column per action (read, write, delete, admin). The key gets only the scopes you tick.
  • The full key is shown one time, when you mint it. Copy it then. You cannot read it back later.
  • Revoke stops a key at once. A revoked key cannot be restored.
An MCP access key acts as the person who minted it. It stops working when that person’s membership ends.
Below the MCP access keys, the Product API keys card points to the product consoles. A key for one product (Voice, CTI, Streams, Tunnel) is created in that product’s console, not here. See Credential types for the full map. The Re-sync engine credentials button sends the organization’s engine credentials to the engine again. You do not need it in normal operation. Use it when FirstByte support asks you to.

​
Branding

White-label appearance: the name, logo and colours every console renders. Branding is deployment-wide. It is the only setting on this screen that changes what EVERY console shows — the portal, the Contact Center and Voice AI consoles, and each modality SPA. A change here is visible to every member of the organization at once.

​
Credentials

Two kinds, and the difference matters:
  • Provider credentials — the organization-wide default keys FirstByte uses to reach a model provider on your behalf. A voice agent with no key of its own falls back to these.
  • Vendor credentials — keys for a third-party platform FirstByte bridges to.
Both are stored sealed and are never returned to the browser after you save them. The screen shows that a credential is set, not what it is.
A voice agent can carry its own provider key on its Keys tab. That override wins. Use the organization default for the common case and the per-agent key when one agent must bill to a different account.

​
Storage

How much recording storage the organization uses. The tab reports the managed, per-tenant recording bucket: the bucket, the tenant prefix, the retention, and the current usage. A trunk with its own recording_url writes to your bucket instead, and that usage does not appear here. See Managed recording storage.

​
Audio

The shared audio library: hold music, prompts and any other clip an agent or a queue plays. Uploading a clip here makes it selectable everywhere it can be played.

​
Where the other settings are