API keys

Mint, list and revoke keys. Keys are hashed at rest and shown once.

Keys are hashed at rest; the raw key is returned exactly once, at creation. Name keys at mint time so the list stays legible.

List keys

GET /v1/api-keys?days=30

{
  "usage_days": 30,
  "no_key_usage": {"runs": 3, "charged": "0.126"},
  "items": [
    {
      "id": "key_...",
      "name": "production agent",
      "environment": "live",
      "display": "rg_live_...a1b2",
      "last_used_at": "2026-09-02T09:30:00+00:00",
      "revoked": false,
      "created_at": "2026-09-01T12:00:00+00:00",
      "usage": {"runs": 412, "charged": "11.84"}
    }
  ]
}

display is prefix and suffix only: the full key is never readable after creation.

usage is what each key ran and was charged over the last days (default 30, up to 365), so a key per agent or per tool doubles as a usage report per agent. Runs made without a key (the dashboard, a connected app) are counted in no_key_usage. To read one key's runs, filter GET /v1/runs with api_key_id.

Create a key

POST /v1/api-keys

{"name": "production agent", "environment": "live"}

Minting needs a dashboard session (rg_sess_, the token the dashboard sign-in returns); an API key or a connected app calling this endpoint gets forbidden. A key that could mint keys would outlive its own revocation. environment is test or live. Production only mints live keys (test keys belong to the sandbox). The response carries the raw key once:

{"id": "key_...", "api_key": "rg_live_...", "note": "Store this key now: it is shown only once."}

Revoke a key

DELETE /v1/api-keys/{key_id}

Revocation is immediate and permanent; mint a new key first when rotating. Rotation is: create the new key, move the integration, revoke the old one.

Reading this as an agent? This page as markdown: /docs/api/keys.md · every page: /docs/llms.txt