API keys and permissions
Choose what each key may do, and keep it on your server.
When you create a key, choose its environment (test or live) and permissions. A website chat only needs Run agents. A reporting script only needs read permissions.
| Permission | Lets the key |
|---|---|
| agents:run | Run agents and continue runs |
| agents:read | Read agents and runs |
| actions:write | Request actions, report results, use MCP |
| actions:read | Read actions |
| policies:read | Read policies |
| activity:read | Read events and balance |
To change a key's permissions, create a new key and revoke the old one. Rotate replaces a key with the same permissions in one step.