> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rerun.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, use and revoke a Rerun API key.

Every API call authenticates with a bearer token in the `Authorization` header.

```http theme={"system"}
POST /api/mcp/account HTTP/1.1
Host: app.rerun.build
Authorization: Bearer rk_your_key
Content-Type: application/json
```

<Note>
  The Rerun API is available on a paid plan. A free trial does not include it, so start your subscription before creating a key.
</Note>

## Create a key

<Steps>
  <Step title="Open the workspace menu">
    In [the Rerun app](https://app.rerun.build), click the workspace pill in the top left corner.
  </Step>

  <Step title="Choose API keys & MCP">
    The dialog lists your active keys and the connection snippets for every supported client.
  </Step>

  <Step title="Name the key and create it">
    Name it after what will hold it, for example `claude-code-laptop` or `ci`. Names are limited to 60 characters.
  </Step>

  <Step title="Copy it now">
    The full key is shown once and never again. Rerun stores only a SHA-256 hash of it, so nobody, including Rerun, can read it back. If you lose it, revoke it and create another.
  </Step>
</Steps>

Any member of the workspace can create a key. A key reaches exactly what the member who created it already reaches.

## Key format and lifecycle

| Property                  | Value                                                                                          |
| ------------------------- | ---------------------------------------------------------------------------------------------- |
| Prefix                    | `rk_`                                                                                          |
| Length                    | 43 characters                                                                                  |
| Scope                     | One workspace, full read and write                                                             |
| Expiry                    | None. A key is valid until you revoke it                                                       |
| Active keys per workspace | 20                                                                                             |
| Storage                   | SHA-256 hash. The first 12 characters are kept in clear so you can tell keys apart in the list |

The key list shows each key by its prefix, plus when it was last used, so you can spot one that nothing calls anymore.

## Revoke a key

Open **API keys & MCP** again and click the revoke button on the row. Revocation takes effect immediately: the next request with that key gets a `401`.

Revoking is the only way to end a key. There is no expiry date and no rotation schedule, so rotate deliberately: create the replacement, update whatever holds the old key, then revoke.

## Scope

A key is bound to a workspace, not to a user, a Box or an agent. It can:

* read and modify every agent of the workspace, including its system prompt and its skills
* read and write every agent database and every Box database
* create and delete scheduled tasks and webhook triggers, and read trigger URLs, which are themselves credentials
* start runs and read their full transcript, including tool inputs and results

There is no read-only mode and no per-agent scoping. If you need a narrower blast radius, use a separate workspace.

<Warning>
  A Rerun API key is a production secret. Keep it in an environment variable or a secret manager, never in a repository, a shared document or a chat message. If a key leaks, revoke it from the app right away.
</Warning>

## Errors

| Condition                                               | Response                                                                                |
| ------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Missing header, malformed key, unknown key, revoked key | `401 Unauthorized`, plain text body                                                     |
| Valid key, failing tool call                            | `200 OK` with a JSON-RPC result carrying `isError: true`. See [Protocol](/api/protocol) |

The `401` is intentionally undetailed. It does not tell you whether the key never existed or was revoked.