API Keys

Overview#

API keys authenticate programmatic callers to the runtime API. Each key belongs to a user and is scrypt-hashed at rest — the full key is shown once at creation.

Scopes#

Scope	Use
runtime	Invoke specific blueprint IDs (configured on the key)
runtime-all	Invoke any deployed blueprint

Management-surface operations require a session cookie, not an API key.

Creating a key#

API Keys → Create:

1. Name the key (for your records)
2. Choose scope (runtime or runtime-all)
3. For runtime scope, select allowed blueprint IDs
4. Copy the key immediately — it cannot be retrieved later

Using a key#

curl -H "Authorization: Bearer bp_..." \
  https://your-instance.example.com/api/runtime/workflows

Or:

curl -H "x-api-key: bp_..." ...

Revocation#

Revoked keys fail authentication immediately. List view shows prefix and last-used timestamp, never the secret.

Security#

• Keys are hashed with scrypt via node:crypto (not bcrypt, not PBKDF2)
• Never log or return key material after creation
• Re-resolve the user on every request — never trust a decoded key without DB lookup

Related#

• Runtime API