Credential types
Domain access
Most commands require a domain. Resolution differs by surface. CLI resolution order:- Explicit
--domain. AEOLO_DOMAIN_ID.- Active domain selected by
aeo domain switch. - Error asking the caller to choose a domain.
domainId as a domain ID, host or brand name. When it is omitted, the account’s only domain or the domain used by the last MCP call is picked; otherwise the tool lists the choices as text.
Membership and billing
Remote requests must pass membership checks before reading or mutating a domain. Credit-metered operations also check billing state.read tokens can run commands classified as read-only by the MCP command registry. read_write is required for mutations, paid jobs, public preview links, deploys, publishes, deletes, and external source access such as Google Drive reads. Read-only commands go through aeo_read; aeo_execute_command carries the rest and should be treated as high risk.
High-risk examples:
aeo content deployaeo post publishaeo visibility check runaeo audit runaeo content generateaeo reference analyzeaeo video generate

