API keys

Open API Keys for the selected Runtime. Choose a name that identifies the application and environment, then select sending access unless the integration must manage resources.

Key lifecycle

1. Create the new key and copy it immediately; the full secret is not shown again.
2. Store the Runtime URL and key in the application’s secret manager.
3. Send a test request from that application.
4. For rotation, deploy the new key to callers, verify traffic, then revoke the old key.

Use separate keys for production, staging, CI and each integration. Never place a Runtime key in browser code. Revocation is immediate for new requests and does not delete historical messages.

Permissions and diagnosis

Sending-only keys submit and inspect the sending surface permitted by Runtime policy. Full-access keys can manage supported Runtime resources. 401 means the key is missing or invalid; 403 means it is valid but lacks permission or a policy blocks the action. Confirm you are calling the Runtime that issued the key.