Skip to main content
An API key is a bearer token that stands for your whole account. You mint it through the API — there is no key screen in the app — and you send it as Authorization: Bearer <token> on every call. Minting one requires a paid plan. On a free account the request is refused with 403:
Upgrade first; see Plans.

​
Creating one

The call is authenticated by your browser session, because it is the thing that gets you your first key:
token is the only time the plaintext exists anywhere you can read it. The server keeps a hash. Copy it into an environment variable or a secret store now; if you lose it, mint another.
​
string
What the key is for. Defaults to API Token - <timestamp>.
​
integer
default:"60"
How long it lives. Zero or less becomes the default of 60; anything above 525600 (a year) is clamped to a year. There is no unlimited option.
endpoint, rate_limit, max_concurrent_requests and usage_note are informational strings the handler fills in, not settings you chose. endpoint in particular is left over from an older API — the chat-completions path it names is not served, and answers 404. The base URL to use is the one on The API.

​
What it can reach

Everything your account can, on both API versions:
The scope field reads api, and that is the only scope there is — it is not a permission set you can narrow. A key is the account, not a subset of it. It starts runs that spend your allowance, reads every run your account owns, and can mint and revoke further keys. Treat it accordingly: a short life for anything short-lived, a separate key for each thing that holds one, and revoke rather than share. What it is not:
  • Not a provider key. Your OpenAI or Anthropic credentials live under Connections and are a separate thing entirely — see Model.
  • Not a login to a machine. The agent’s own tools run inside the machine and need no key from you.
  • Not scoped to one harness, one machine or one run.
Authentication has the refusals — what a missing, malformed, expired or revoked key answers, and why a resource that is not yours looks identical to one that does not exist.

​
Listing

Expired keys are dropped from this list rather than shown as dead rows, so everything you see here is live. The id is what you revoke by; it is not the token and it is safe to log.

​
Revoking

It takes effect at once — the next request with that token gets a 401, with no cache to wait out. A key you no longer recognize is a key to revoke; there is no cost to minting a fresh one. Letting a key expire has the same end state. If you know a key is for one job, give it a duration_minutes that covers the job and nothing more, and you never have to remember to come back.

Authentication

Sending the key, and every shape a refusal takes.

Plans

Which plans can mint a key at all.