API Keys
Generate, copy, identify, and revoke a personal Runner API key safely.
API keys are personal secrets for programmatic Runner access. Create one only for an application you trust, store it securely, and revoke it when it is no longer needed.
What this covers
You will know how to create and save the one-time secret, identify existing keys without exposing them, and revoke a key with confirmation.
Availability and prerequisites
- API Keys is conditional and appears only when enabled for your account.
- Keys belong to your personal account, not one store.
- Never put a full key in chat, Agent Memory, a Skill, a screenshot, source control, or product documentation.
Entry path
Select avatar → Settings → Personal → API Keys. If the entry is absent, the feature is not available for the current account.
Controls
| Entry or button | Why it is useful | What happens next |
|---|---|---|
| Generate New Key | Create a new credential. | A dialog opens with an optional Name field. |
| Name | Identify the application later without exposing the secret. | The name appears in the key table; blank creates an untitled key. |
| Create Key | Generate the credential. | Runner opens API Key Generated and displays the full secret once. |
| Eye icon | Check the full newly generated value before storing it. | The one-time value is shown or masked in the success dialog. |
| Copy icon | Copy the new key accurately. | Runner copies it to the clipboard and shows confirmation. |
| I have saved it | Close the one-time secret view. | The full value is cleared from the dialog and cannot be shown again there. |
| Existing key table | Identify keys safely. | Runner shows Name, Prefix, Created, and Last Used, not the full secret. |
| Delete icon | Revoke an existing key. | A confirmation explains that revocation cannot be undone. |
| Revoke | Disable the selected key. | After success, the key is removed from the list and can no longer authenticate. |
Generate and store a key
- Open Personal → API Keys.
- Select Generate New Key.
- Enter a descriptive Name, such as the application or environment. Do not put a secret in the name.
- Select Create Key.
- In API Key Generated, reveal the key only if needed and select Copy.
- Store it in a trusted secret manager.
- Confirm the stored value before selecting I have saved it.
- Use the table Prefix to identify the key later without exposing the full value.
Runner warns that the full key will not be shown again. If you close the dialog without saving it, revoke that key and create a replacement rather than trying to recover the secret.
Revoke a key
- Match the intended key by Name and Prefix.
- Select its delete icon.
- Review the Revoke confirmation.
- Select Revoke only when the dependent application is ready to stop using it.
- Confirm API key revoked and remove the old secret from the application.
Revocation is destructive and cannot be undone. Create a new key if access is needed again.
States and limits
- No API keys yet is the normal empty state.
- A new key's full value appears only in its success dialog.
- Existing rows show a prefix and usage dates, not a recoverable key.
- Never under Last Used means Runner has not recorded a request for that key.
- Create and Revoke buttons show progress and should not be submitted repeatedly.
Troubleshooting
- If API Keys is missing, do not use a copied direct link; the feature is disabled for this account.
- If clipboard copy fails, reveal the new value and copy it manually into a secure secret manager, then hide it again.
- If you lost a full key, revoke its row and generate a replacement.
- If an application stops working after revocation, update it with a newly created key; the old key cannot be restored.
- If the wrong key was selected, Cancel the confirmation and compare Name and Prefix again.