Agent API keys

Organization Settings > Integrations > Agent API Keys issues keys that let an external agent act inside your org over a plain HTTP API - the same door a person uses, opened for code instead.

Two kinds of agent

Shared access: the agent acts inside your org with whatever permissions you pick, on your identity. Full account: the agent additionally gets its own org-member identity - it appears in your member list, cannot log in interactively, but carries its own audit identity for every action it takes.

Authentication and limits

  • →Each agent carries an API key passed via the Authorization header, prefixed armor_pk_ and expiring after 90 days.
  • →Rate limits: 100 requests/minute, 1,000 requests/hour per agent.
  • →Permissions: scopes control access - swarm:read for GET, swarm:write for POST, and similarly scoped permissions elsewhere.
  • →Rotate or Revoke are one click per agent on this page; a rotated key invalidates the old one immediately.
The Integrations > Agent API Keys tab with an issued agent, authentication details, and code examples
↳A key an agent can use like a person would, scoped, rate-limited, and revocable in one click.

Code Examples on this page cover cURL, Python, and JavaScript, so wiring up a new agent does not start from a blank editor.