API keys
Limit what each API key may spend and start, and mint keys from code with management keys.
API keys
An API key authenticates calls to the Sandcovery API. Send it as a bearer token:
-H "Authorization: Bearer $SANDCOVERY_API_KEY"Each key can carry limits:
| Limit | Effect |
|---|---|
| Spend limit | Refuses new creates once the key's list-price cost reaches the limit, with spend_limit_reached |
| Provider allowlist | Routes only to these providers |
| Concurrency cap | Refuses a create while this many of the key's sandboxes are running |
| Maximum TTL | Refuses a create that asks for a longer TTL |
| Expiry | Stops the key working after this time |
The spend limit counts the list-price cost of sandboxes on your own provider keys, so it caps what a leaked or runaway key can run up at your providers.
Management keys
A management key mints and revokes API keys from code. It cannot create sandboxes. Use it to give each agent, job, or customer its own key with its own limits.
Storage
Sandcovery stores a hash of each key, never the key itself, and shows the full key only once, when you create it.