Start Here
API Keys
How Agent Mag API keys should be created, scoped, rotated, and used.
Status: Preview.
Agent Mag API keys authenticate hosted APIs. Keys belong to a workspace and should be managed from the dashboard.
Header
Key Rules
| Rule | Requirement |
|---|---|
| Scope | Keys should be scoped by workspace and environment. |
| Storage | Store keys in environment variables or a secret manager. |
| Rotation | Rotate keys from the dashboard when a teammate leaves or a key leaks. |
| Logging | Never log full keys. Show only a short fingerprint. |
| Billing | Usage is attributed to the key, workspace, endpoint, and job. |