---
title: "Set Sandbox Credential"
method: PUT
path: "/api/v1/tool-settings/sandbox/credential"
tags: ["tool-settings"]
---

# Set Sandbox Credential

`PUT /api/v1/tool-settings/sandbox/credential`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `Otari-Key`
  - API key in header `x-api-key`

Store the key this deployment's hosted sandbox provider leases sandboxes with.

Wins over the provider's environment variable (``E2B_API_KEY``), on this
worker at once and on every other within 30 seconds, so a rotated key needs
no redeploy. Refused for the ``protocol`` provider, which takes no key of
its own. Operator-gated.

## Request body

- SandboxCredentialRequest: The key to lease hosted sandboxes with.
  - `api_key` string, required

## Response `200`

Successful Response

- SandboxCredentialPublic: Where the key a hosted sandbox provider leases with comes from. Never the key itself.
  - `env_var` string, required: The environment variable a deployment that stores no key is read from.
  - `last4` string, nullable: The key's last four characters, to tell keys apart.
  - `source` 'stored' | 'environment', nullable, required: 'stored' for a key set here, which wins; 'environment' for the provider's own environment variable; null when there is neither and code execution fails until one is set.

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-23** `84952d275e25`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mozilla-ai/apis/otari/changes/api/v1/tool-settings/sandbox/credential/put.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) - [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) - [OpenAPI document](https://skmtc.dev/mozilla-ai/apis/otari/revisions/42276d3c251d?raw)