---
title: "Make a key with this key, with no browser: a key per worker in an agent swarm."
method: POST
path: "/v1/keys"
tags: ["keys"]
---

# Make a key with this key, with no browser: a key per worker in an agent swarm.

`POST /v1/keys`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/keys`
- Auth: HTTP bearer

Needs a full-access key made by an owner or admin (a wallet account's key is one). A read-only key, a developer's or one in a compartment cannot. The new key never has more than this one: account-wide only from an account-wide key, this key's expiry and per-request cap, and when this key has a daily limit, the daily limits of the keys it made add up to at most its own. Each key gets its own agent, so its sandboxes, spend and audit rows are its own. At most 100 live keys made this way in an account, and 1,000 made in any 24 hours; revoke a worker's key when it is done. Every key made is in the audit log as key.created, naming the key that made it.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `name` string, required: The key's name, and its agent's.
  - `access` 'full' | 'read': full: every action in every product (the default). read: every read and nothing else.
  - `reach` 'agent' | 'account': agent (the default): the key sees and acts on only what its own agent makes, so a worker sees only its own sandboxes. account: everything in the account; only an account-wide key can make one.
  - `dailyLimitMicros` integer, nullable: The most the key's agent may commit in any 24 hours, in integer microdollars (5000000 = $5), or null for none. Required when the making key has a limit; the limits of the keys a key made add up to at most its own. A read-only key takes none.
  - `sandboxes` string[]: Limit the key to these sandboxes, by id: it is served only their own routes (get, metrics, stop, pause, wake, restart, exec, processes, files, interpreter) and only the actions given, and calls them by id. Not with access or reach. Only sandboxes this key acts on, outside every compartment.
  - `actions` string[]: With sandboxes: what the key may do to them. get reads them; create starts, wakes and restarts them (never makes a sandbox), and is the one that spends; stop stops and pauses them; exec runs commands and processes; read_file and write_file reach their files.

## Response `200`

Success

- object
  - `key` string: The new key. Shown once: Runtime keeps only its hash. A retry with the same Idempotency-Key answers without it.
  - `keyId` string, required: The key's id.
  - `agentId` string, required: The new key's own agent: what it makes is that agent's.
  - `orgId` string, required
  - `name` string, required
  - `access` 'full' | 'read' | 'selected', required
  - `reach` 'agent' | 'account' | 'sandboxes', required: agent: what its own agent makes. account: everything in the account. sandboxes: only the sandboxes it is limited to.
  - `dailyLimitMicros` integer, nullable, required: The most the key's agent may commit in any 24 hours, in integer microdollars (5000000 = $5), or null for none. Required when the making key has a limit; the limits of the keys a key made add up to at most its own. A read-only key takes none.
  - `sandboxes` string[], nullable: The sandboxes it is limited to, by id, or null for a key that is not limited.
  - `actions` string[], nullable: What it may do, for a key of named actions, or null for full and read.
  - `expires` string, date-time, nullable, required: When it stops working: the making key's expiry, or null for until revoked.
  - `madeBy` string, required: The id of the key that made it.

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)