Skip to main content
Every API call authenticates with a bearer token in the Authorization header.
The Rerun API is available on a paid plan. A free trial does not include it, so start your subscription before creating a key.

​
Create a key

1

Open the workspace menu

In the Rerun app, click the workspace pill in the top left corner.
2

Choose API keys & MCP

The dialog lists your active keys and the connection snippets for every supported client.
3

Name the key and create it

Name it after what will hold it, for example claude-code-laptop or ci. Names are limited to 60 characters.
4

Copy it now

The full key is shown once and never again. Rerun stores only a SHA-256 hash of it, so nobody, including Rerun, can read it back. If you lose it, revoke it and create another.
Any member of the workspace can create a key. A key reaches exactly what the member who created it already reaches.

​
Key format and lifecycle

The key list shows each key by its prefix, plus when it was last used, so you can spot one that nothing calls anymore.

​
Revoke a key

Open API keys & MCP again and click the revoke button on the row. Revocation takes effect immediately: the next request with that key gets a 401. Revoking is the only way to end a key. There is no expiry date and no rotation schedule, so rotate deliberately: create the replacement, update whatever holds the old key, then revoke.

​
Scope

A key is bound to a workspace, not to a user, a Box or an agent. It can:
  • read and modify every agent of the workspace, including its system prompt and its skills
  • read and write every agent database and every Box database
  • create and delete scheduled tasks and webhook triggers, and read trigger URLs, which are themselves credentials
  • start runs and read their full transcript, including tool inputs and results
There is no read-only mode and no per-agent scoping. If you need a narrower blast radius, use a separate workspace.
A Rerun API key is a production secret. Keep it in an environment variable or a secret manager, never in a repository, a shared document or a chat message. If a key leaks, revoke it from the app right away.

​
Errors

The 401 is intentionally undetailed. It does not tell you whether the key never existed or was revoked.