The Own Key Setup: a ServiceTitan API access setup checklist for AI agents

This is the checklist from the Cortex video on the Own Key Setup. The four steps are the same as in the video and in the same order:

1. The app. Your admin creates the app in My Apps, adds your tenant and copies the application key.
2. The scope. You tick only the parts of ServiceTitan the agent's job needs.
3. The secret. Your admin connects the app under API Application Access and generates the client secret, which goes straight into a password manager.
4. The test. The agent practices in ServiceTitan's integration environment before it sees live work.

Done this way, the agent has its own key. You can switch it off without resetting anyone's password, and you can see exactly what it was allowed to reach.

Why an agent should never use a staff login

ServiceTitan's own developer portal setup page says its APIs use OAuth 2.0 with a machine-to-machine grant. A program shows a client ID and secret, gets a token back, then calls the API with that token and an application key. No person logs in.

A shared login works against you in three ways. It can see everything that person can see, including screens the agent has no reason to open. Its actions look like that person's actions in your records. And when the person leaves, the password reset breaks the agent, usually on a day nobody remembers it was there.

Who this is for and what you need first

This is for HVAC, plumbing and electrical companies on ServiceTitan that are about to let an outside tool or agent read their data. You do not need to be technical, but the person doing steps 1 and 3 needs the right permissions.

• Two permissions. The ServiceTitan page lists Generate API Application Key and Manage API Application Access for the person doing the setup.
• The right login. The same page says you cannot use an Enterprise Hub or Partner Portal login for this.
• One job for the agent. Write one sentence describing what it will do, for example "find unsold estimates older than five days and draft a follow-up for a CSR to approve". The scopes come from that sentence.
• A password manager the office already uses, with a shared vault for integration secrets.

Step 1, the app

In the developer portal, the admin creates the app under My Apps, adds your tenant ID and then copies the application key, according to ServiceTitan's setup page.

Name the app after its job, not after the vendor who built it. "Bluewater estimate follow-up agent" tells the next admin what it does. "Agent 1" does not.

Record three things in your notes: the app name, who created it and the date.

Step 2, the scope

The scope is the real safety control. Makini, a company that sells ServiceTitan integrations, lists the scope groups as Accounting, CRM, Dispatch, Forms, Job Booking, Job Planning and Management, Marketing, Pricebook, Settings and Timesheets. It also warns that a missing scope causes permission errors, which is the right kind of error: it tells you the agent tried to reach something you did not give it.

The OWASP GenAI Security Project calls this risk excessive agency and lists its causes as too much functionality, too many permissions and too much autonomy. Its first fixes are to give fewer functions and fewer permissions.

Suggested starting scopes for common agents. These are our recommendations, not ServiceTitan's. Start with the smallest set and add a scope only when the agent shows it needs one.

Agent's job	Start with	Leave off
Unsold estimate follow-up drafts	CRM, Job Booking	Accounting, Pricebook, Timesheets, Settings
Finished job with no invoice	Job Planning and Management, Accounting	Marketing, Timesheets, Settings
Maintenance customers due this season	CRM, Job Booking	Accounting, Pricebook, Timesheets
Morning summary for the owner	Job Planning and Management, Dispatch	Settings, Pricebook, Timesheets
Tech timesheet questions	Timesheets	Everything a timesheet question does not need

When an agent only drafts, ask the builder which of its calls write data. If the answer is "none", hold them to it.

Step 3, the secret

The admin goes to Settings, Integrations, API Application Access, chooses Connect New App, picks the app and allows access. Then they copy the client ID and generate the client secret. That path is from ServiceTitan's page.

Makini's guide says the secret cannot be viewed again once that window closes, and that the app has to be in an Enabled state to work. So do this with the password manager already open:

• Paste the client ID and secret into one vault entry named after the app.
• Note who generated it and the date.
• Share the entry with the builder through the password manager, never by email or text.
• If the secret is ever lost or exposed, generate a new one and update whatever uses it.

Because the app has its own credentials, turning it off is an admin action on the app. Nobody else's login changes.

Step 4, the test

ServiceTitan says developers can request an integration environment through the developer site, and that for production customers it is a clone of production data. Ask for one before the agent touches live jobs.

What to check there:

• The agent finds the records you expect. Pick five real cases from last month and see if it flags all five.
• It finds nothing it should not. Look for drafts about cancelled jobs, paid invoices or customers who asked not to be contacted.
• It stays inside its scopes. A permission error in testing is good news.
• It runs slowly enough. A 2024 vendor guide from Rollout gives 60 calls per second per application per tenant for most APIs and five runs of the same report per minute, and says the page may be out of date. Ask your ServiceTitan rep for current limits.

Keep the first live weeks to drafts only, with a CSR or office manager approving each one. We explain why in human-in-the-loop AI.

Check ServiceTitan's own AI first

ServiceTitan is adding AI to the product. In September 2025 Contractor magazine reported on Atlas, an assistant that can run reports, find jobs and dispatch technicians from plain-English commands. If ServiceTitan's own tools cover the job, use them. An outside agent with its own key earns its place when the work crosses tools, such as ServiceTitan plus QuickBooks plus your phones, or when you want your own rules about who gets contacted.

How to tell the setup is right

• You can name every app connected to your tenant and what each one does.
• Each app has only the scopes on its row of the table above, or a written reason for more.
• Every secret is in the password manager, with a name and a date.
• You have switched the agent off once, on purpose, and back on, and nothing else broke.

For how agents work inside ServiceTitan once connected, read how an AI agent for ServiceTitan works. If you would rather have someone check your tenant with you, your free AI Operations Audit covers it.