Skip to content

API Keys

An API key lets a script, Terraform, an MCP client or an AI agent call the console's API as you. A key can be narrowed to a scope and given an expiry, so a key handed to a tool can do only what that tool needs.

Create a key

  1. Settings → My API Keys → Generate API Key.

  2. Pick the Scope:

    Scope Allows
    Full Everything your account can do.
    Read-only GET, HEAD and OPTIONS only, and not even the reads that hand out a credential: VM console and host SSH tickets, kubeconfigs, marketplace tokens, the metrics token, the config export and the agent download.
    Sandbox Only /api/sandboxes/*. For AI agents that create and use AI sandboxes and nothing else.

  3. Expires after (days): up to 365. Leave blank for no expiry.

  4. Generate, then copy the key now. It's stored hashed and can't be shown again.

A scope only ever narrows your role. A read-only key held by a Tenant Viewer can't do more than that viewer can, and a full key held by a Tenant Operator still can't reach other tenants. A scoped key can't create new keys.

Use a key

Send it in the X-API-Key header:

curl -H "X-API-Key: <key>" https://console.example.com/api/vms
  • An expired key gets 401.
  • A request outside the key's scope gets 403.

Manage keys

The My API Keys table shows each key's prefix, scope, expiry and when it was last used. Look for keys that haven't been used in months. Revoke deletes a key at once.

Creating and revoking keys is recorded in the audit log. Keys created before scopes existed are Full with no expiry, so existing integrations keep working.

Keys you didn't create

AI Workers mint a short-lived key for each worker VM and delete it when the worker finishes. Those keys aren't listed under My API Keys.

See also