API Keys

Creating an API key

1. Go to Settings → Security
2. Click New API Key
3. Give it a descriptive name (e.g., “Production Backend”)
4. Set an optional expiry date
5. Click Create
6. Copy the key immediately — it’s only shown once

Keys start with sk_live_ and look like: sk_live_abc123xyz789...

---

Key scope

An API key is scoped to your organization, not to a single agent. You choose which agent to act as at exchange time by passing its agent_id — so one key can run any agent in the org. The token you get back is bound to that agent (its claims carry the agent_id you supplied) and expires after one hour.

Because a key can reach every agent in the org, treat it as an org-level secret: create one key per environment and revoke any key that may have leaked.

---

Using an API key

API keys are not sent directly to the agent API. Exchange the key for a JWT first:

# 1. Exchange API key for JWT
curl -X POST https://profile-api.auteryn.ai/api/v1/auth/exchange/agent-token \
  -H "X-API-Key: sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "your-agent-uuid"}'

# 2. Call agent API with JWT
curl -X POST https://agent-api.auteryn.ai/api/run \
  -H "Authorization: Bearer eyJ..." \
  -H "X-Agent-Id: your-agent-uuid" \
  -H "Content-Type: application/json" \
  -d '{"messages": [{"role": "user", "content": "Hello"}], "stream": false}'

See Authentication → for the full flow.

---

Best practices

• Never commit keys to version control — use environment variables
• One key per environment — separate keys for dev, staging, and production
• Set expiry dates for keys needed only temporarily
• Rotate keys regularly, especially if a team member with key access leaves

---

Revoking a key

Settings → API Keys → Revoke next to the key you want to remove.

Revocation takes effect immediately.