API keys
Create an API key with a limited permission set, copy it once, revoke it — and what a key can call.
Settings → Connections → API keys. Needs a plan with API keys (Pro and up); lower plans
see a lock. Listing needs apiKey.read, creating apiKey.create, revoking apiKey.revoke.
Create a key
Create a key → What it is for (a name) and What it may do — a checkbox list of permissions.
Only permissions you hold (and none of the admin ones) can be ticked. A key is never stronger than the person who made it.
Create. The Copy this now screen shows the rag_… key exactly once. Afterwards the list
shows only the rag_live_•••• hint and last used.
A lost key cannot be recovered — Revoke it and create a new one.
What a key can call
Send it as Authorization: Bearer rag_… to the Developer API endpoints, currently: list agents,
run an agent (queued, not streamed), read a run's status and steps. Every request re-checks the
key's permissions. Limit: 120 requests per minute per key.
A key cannot sign in to the app or manage other keys.
Revoking
Revoke on the key's row — immediate. A run already in progress is not stopped, but the next request is refused.
Your APIs — calling your own systems
Register your own API so an agent can call it through Call a connected system, with method and path limits.
Databases — let an agent look things up in your database
Connect a read-only database, read its schema, and pre-approve the questions an agent may run. The agent never writes SQL.