Glossary · Identity & access

API key scope

A named permission on a key — run, skills:read, skills:write, tenants:provision — that decides which endpoints it may call.

Start free All terms

What is api key scope?

Scopes narrow what a key can do. A default key carries run plus skills read and write; provisioning sub-tenants requires a separate scope that a default key does not have, and calling that endpoint without it is a 403 rather than a silent failure.

Why it matters

It is the difference between a key you can safely put in a worker and a key that can create billing relationships. Scoping is also how a reseller separates the key its own product uses from the key that provisions customers.

Related terms

Sub-tenantA tenant provisioned under your account, with its own key and library, billing either to its own balance or to your pool.
Multi-tenant isolationThe guarantee that one tenant’s runs, skills, sessions and secrets are unreachable from another — enforced in the database, not the application.
Row-level security (RLS)A database policy that decides per row whether the current identity may read or write it — the enforcement point for tenant isolation.
CreditThe unit every action is billed in, settled as the higher of a flat per-action floor and the metered cost the action actually incurred.

See it in context

Capability: sub-tenants & reseller billing
API reference

Back to the full glossary

Put your agent to work. Keep the decision.

Give your agent a real browser, authorize the accounts it may use, and keep control of every step. Repeated runs compile into skills that replay without a model.

Start free See pricing