Which permissions should I give an Agent API key?
Give each key the fewest permissions that do the job.
| Use | Permissions |
|---|---|
| A job that starts runs and waits for results | runs:write, runs:read |
| A dashboard showing runs and spend | runs:read, account:read |
| A budget monitor | account:read |
| A "stop everything" tool | runs:write, runs:read (to find and cancel runs) |
Why it matters#
If a key leaks, it can only do what its permissions allow. A read-only dashboard key can't start runs that spend your credits.
Missing a permission?#
The request answers 403 insufficient_scope. Permissions are chosen when you create a key, so create a new key with the right ones and revoke the old one.
Learn more#
Related articles
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.