Managing API keys

Create and manage API keys for accessing Runtype programmatically via the Runtype API.

What are Runtype API keys?

API keys let you call Runtype’s API to trigger Flows, manage resources, and access data programmatically.

These are different from:

• Product API keys: For calling Product surfaces (see Setting up an API surface)
• Provider keys: For OpenAI, Anthropic, etc. (see Connecting AI model providers)

Creating an API key

1. Go to Settings → API
2. Click Create New API Key
3. Configure:
   • Name: Descriptive identifier (e.g., “CI/CD pipeline”)
   • Environment: Test or Production
   • Permissions: Select individual scopes or use a permission template
   • Expiration Date: Optional date picker, or leave blank for no expiration
4. Click Create
5. Copy the key immediately — it will not be shown again

Key permissions

Permissions are organized into scopes and groups. You can select a permission template for common configurations or pick individual scopes. Use least privilege — only grant the permissions needed.

Using API keys

Include in the Authorization header:

$
curl https://api.runtype.com/v1/flows \
>
  -H "Authorization: Bearer rt_xxxxx"

See the API documentation for endpoint details.

Key prefixes

Runtype API keys start with:

• rt_live_ — Production keys
• rt_test_ — Test mode keys (sandbox environment)

Rotating keys

Change compromised keys:

1. Create a new key with the same permissions
2. Update your applications to use the new key
3. Revoke the old key

Revoking keys

1. Go to Settings → API
2. Find the key
3. Click Revoke
4. Confirm

Revoked keys stop working immediately.

Never commit API keys to version control or expose them in client-side code. Use environment variables and secrets management.

Best practices

• Descriptive names: “Production deploy script” not “Key 1”
• Separate keys per use: Different keys for CI/CD, scripts, integrations
• Rotate regularly: Generate new keys every 90 days
• Monitor usage: Check which keys are actively used
• Set expiration: Keys auto-expire for security

Next steps

• API documentation (external) for endpoint reference
• Setting up an API surface for Product API keys
• Authenticating with product API keys