Settings

Managing API keys

Use API keys to authenticate programmatic requests to the Runtype API. Create keys on the API page in Settings. Assign permissions and set expiration dates.

Understand Runtype API keys

Use Runtype API keys to trigger Flows, manage resources, and read data through the Runtype API. Use a different key type for other services:

  • Product API keys authenticate requests to API Surfaces.
  • Provider API keys authenticate requests to external AI model providers.

Before you begin

Sign in to the Runtype Dashboard before you create an API key.

Create an API key

To create an API key, follow these steps:

  1. On Settings > API, click Create New API Key.
  2. In the Name field, enter a descriptive name.
  3. In Environment, select Test or Production.
  4. Optional: In Permission Template, select a template for a common permission set.
  5. In Permissions, select the scopes that the integration requires.
  6. Optional: In Expiration Date, select a date. Leave the field empty for no expiration.
  7. Click Create API Key.
  8. Copy the key from the success dialog and store it securely. The dashboard does not reveal Production keys again. Use Reveal to view an active Test key.

View organization API keys as an admin

If you have the Admin role in an organization, Settings > API lists every management API key that any member of the organization created, not only your own keys. Members see only the keys they created.

A key that another member created shows the owner’s name and a View only badge in place of the action buttons. You cannot edit, regenerate, reveal, or delete a key that another member created. The key’s search hint is also hidden for keys you did not create.

This wider view applies only to the dashboard. A request that authenticates with an API key always lists the keys of the user who created that key, even if that user is an admin.

For role details, see Team members and permissions.

Choose permissions

Permissions control the API operations that a key can perform. Select a permission template for a group of scopes. Alternatively, select individual scopes in Permissions.

Grant only the permissions that your integration requires. Review the permissions when you edit or regenerate a key.

Use an API key

Send an API key in the Authorization header as a Bearer token. The following cURL command lists your Flows:

List Flows
$curl https://api.runtype.com/v1/flows \
>  -H "Authorization: Bearer rt_live_YOUR_API_KEY"

Replace rt_live_YOUR_API_KEY with your Production Runtype API key. Store the key in an environment variable or a secrets manager. Do not put it in source code.

Understand key prefixes

Runtype uses the following prefixes for management API keys:

  • rt_live_: Production keys. Runtype does not reveal these keys after creation.
  • rt_test_: Test keys. They support 20 executions per day and 200 executions over the key’s lifetime. Use Reveal to view an active Test key.

Regenerate an API key

Regenerate an API key to replace its secret while preserving its name, permissions, expiration date, and environment.

To regenerate an API key, follow these steps:

  1. On Settings > API, find the key that you want to replace.
  2. Click Regenerate for the key.
  3. In the confirmation dialog, click Regenerate API Key. The previous key value becomes invalid.
  4. Copy the replacement key from the success dialog.
  5. Update your applications and integrations to use the replacement key.

Delete an API key

Delete an API key to revoke it permanently. After deletion, requests that use the key fail authentication.

To delete an API key, follow these steps:

  1. On Settings > API, find the key that you want to revoke.
  2. Click Delete for the key.
  3. In the confirmation dialog, click Delete API Key.

Protect API keys

Follow these practices to protect your API keys:

  • Use separate keys: Create a key for each integration, CI pipeline, or script.
  • Store keys securely: Use environment variables or a secrets manager instead of source code.
  • Grant least privilege: Select only the permissions that each integration requires.
  • Set expiration dates: Set an expiration date when you create or edit a key.
  • Regenerate exposed keys: Replace a key if you expose it in a public repository, log, or client-side application.
  • Review usage: Open the Analytics tab on the API page to review key activity. Admins see activity for every key in the organization, with an Owner column.

Next steps

Use these guides to continue: