API keys

An API key is how your agent talks to AIec. It is shown once, stored hashed, and can be rotated or revoked at any time.

Public alpha signup is invite-only. If you do not have an account yet, request access. The key management UI below is live for invited accounts.

Create a key

Open the dashboard with the key you were invited with.
Choose a name that says where it will run, for example ci-agent or local-dev.
Select the scopes it needs. Least privilege is the default: a key that only creates and execs should not be able to read billing or rotate other keys.
Copy the key. It is shown exactly once — AIec stores only a hash and cannot show it again.

Scopes

Scope	Allows
`sandboxes:read`	List and inspect sandboxes
`sandboxes:write`	Create, start, stop, destroy sandboxes
`exec:write`	Run commands and manage files
`snapshots:read`	List and restore snapshots
`snapshots:write`	Create and delete snapshots
`artifacts:read` / `artifacts:write`	Upload and download artifacts
`usage:read`	Read usage and quota for your tenant
`keys:write`	Create, rotate and revoke API keys

Using a key

curl https://api.aiec.gobrowse.dev/v1/sandboxes \
  -H "Authorization: Bearer af_live_..."

from agentforge import AIec
af = AIec(api_key="af_live_...")

# or, without hardcoding it
export AGENTFORGE_API_KEY="af_live_..."
export AGENTFORGE_URL="https://api.aiec.gobrowse.dev"

Rotate a key

Rotation issues a new key and immediately invalidates the old one. There is no overlap window, so rotate deliberately — a running agent using the old key will start receiving 401 the moment you rotate.

Create the replacement key with the same scopes.
Update the secret store your agent reads from.
Revoke the old key.

Revoke a key

Revocation takes effect immediately. A revoked key returns 401 unauthorized and the action is recorded in the tenant's audit log.

Good practice

One key per workload. It makes revocation precise.
Least-privilege scopes. Most agents need only sandboxes:read, sandboxes:write and exec:write.
Never commit a key. Use your platform's secret store.
Rotate when someone leaves, or when a key may have been logged.
Set a short expiry on CI keys so a leaked key stops working on its own.

Keys are transmitted only over TLS. AIec stores a hash, never a recoverable value, and never logs a key. If you believe a key has been exposed, revoke it and report it — see security.