Agents

API keys

An API key lets a script, a CI job or another service call the Agents API as you, without a browser. Make one on the API keys page.

#Making a key

Choose New key, give it a name that says what it's for, and pick:

• Scope: Read keys can only read (GET). Read and write keys can also apply resources, start and cancel runs, and decide approvals.
• Expires: after 30, 90 or 365 days, or never. Shorter is safer.

The key is shown once, when you make it. Copy it somewhere safe, such as your CI's secret store. SpudSuite keeps only a hash of it.

#Using a key

Send it as a bearer token:

curl "https://spudsuite.com/api/w/acme/agents/runs" \
  -H "Authorization: Bearer $SPUDSUITE_API_KEY"

A key:

• belongs to one workspace and acts with your role in it, so it can never do more than you can;
• reaches the Agents API only, not Docs, Projects, Chat or account settings;
• can't make or revoke API keys, or use the assistant.

The API reference marks which endpoints take a key.

#Revoking

Revoke stops a key straight away. You can revoke your own keys; workspace admins see everyone's and can revoke any of them. Keys that stop working because their owner leaves the workspace stop at once too.