* The **email** is not used for anything, and will likely be removed in a
future version of Zulip.
* The **bot type** determines what the bot can and can't do (see below).
* The **API key** is how the bot identifies itself to Zulip. Anyone with the
bot's API key can impersonate the bot.
## Bot type
The **bot type** determines what the bot can do.
Bot type | Permissions | Common uses
---|---|---
Incoming webhook | Send messages into Zulip | Third party integrations
Outgoing webhook | Send messages into Zulip, read messages where the bot is addressed | Third party integrations, most custom bots <!-- # ignorelongline -->
Generic | Anything the bot creator can do | Automating tasks, bots that listen to all messages on a stream
API super bot (self-hosted only) | Anything any user can do | Mirroring
It's generally best to pick the most restricted bot type that is sufficient
to do the task at hand. Anyone with the bot's API key can do anything the
bot can.
A few more details:
* **Outgoing webhook**: The bot can read private messages where the bot is a