API keys and agent access

Every program that acts in your organization has its own identity, and you can see and stop each one. Open Settings, then the organization's API keys. It lists them in three groups:

• API keys, for programs that can't sign in from a browser: CI, containers, scripts.
• Signed in with OAuth, the harnesses you connected by signing in (Connect a harness).
• Desk identities, the agents you hired, each acting from its desk.

Retired ones are folded under Revoked.

Create an API key#

1. Press Create API key.
2. Give it a Label that names the program that will hold it, and choose the Workspace it acts in.
3. Copy the key from Key for label. It starts with uak_, and the Console shows it only once: after Done, it isn't shown again.

A key lets a program act as you in that one workspace, and read every connection you can reach. Give it only to programs you trust with that, and retire it when they're done. Hand it to the program through its own secret store, never in a file, a chat or a command line. Connect a harness shows commands that ask for the key instead.

Retire a key or an agent#

Open the ⋯ menu on its row and choose Retire…. Its credential stops working and it can no longer act. A hired agent's desk is stopped and archived, and every agent it hired goes with it. This can't be undone.

Pause all agents#

Pause all agents, at the bottom, is the switch for when you don't yet know which agent is misbehaving. It refuses every agent request in the organization at once, and admits no new ones. People and Computes are unaffected, and their credentials are kept: everything works again the moment you resume. While agents are paused, no key can be created and no harness connected.

Only the organization's owners and admins can pause agents.

Principals#

Principals, next to API keys in the organization's settings, lists every identity in the organization in one place: People, Agents and Computes. Owners and admins can see it.