An organization API key provides programmatic access to Agents, Box, Powers, or Gateway. Console uses your signed-in session and does not require a key. Only an owner or admin of the selected organization can create, list, or revoke keys.
Create a key
- Open Console, select the target organization, and open API Keys. Product API pages can preselect their product and project scope.
- Create a key and give it a name that describes its purpose.
- Select one or more products, then choose permissions separately for each product.
- Choose the entire organization or a specific project, and set an expiration.
- Immediately copy the complete key into your application’s secret configuration or secret manager.
The complete key is shown only once. Closing the result, leaving the page, or switching organizations removes access to it; the list shows only a prefix. If you no longer have the complete key, revoke it and create another.
Product permissions
| Product | Available capabilities |
|---|---|
| Agents | agentRun, with optional browserRun and sandboxRun. |
| Box | fileRead, with optional fileWrite and boxRun. |
| Powers | catalogRead, connectionRead, connectionWrite, toolRun, runRead, usageRead. |
| Gateway | modelRead, modelInvoke, configRead, configWrite, usageRead. |
Agents and Box require their respective base capabilities, agentRun and fileRead. Powers and Gateway accept any nonempty capability set. A Gateway key used only for model calls can have just modelInvoke; add modelRead if it needs to list models.
One key can cover several products, but grants remain separate. Powers usageRead does not grant Gateway usage access, and Agents access does not grant direct Box access. Key scopes cannot expand organization entitlements. Granting browserRun does not guarantee complete browser automation in the current environment.
Project scope
- Entire organization: covers the selected products in current and future projects, plus resources without a project, subject to actual permissions.
- Specific project: restricts all selected products to that project. Request parameters and headers cannot widen the scope.
Separate application keys allow independent revocation and narrower permissions. Some organization-wide management functions, such as Gateway budget management, require an organization-scoped key.
Use and rotate keys
Use the endpoint shown on the product’s API page and send your organization API key in the Authorization: Bearer header. Keep keys out of public webpages, repositories, URLs, and logs. Provider BYOK credentials belong in product connection settings and do not replace an organization API key.
Use https://sinecloud.dev plus the documented complete path, with your actual resource IDs.
To rotate, create a replacement key, update the application, and revoke the old key. If the creation response is uncertain, inspect the list and recover using the original creation draft. Revoke an unrecoverable key before replacing it instead of repeatedly submitting new creation requests.
Revoke or retire access
Check a key’s permissions and details, then confirm revocation. Revocation is permanent and blocks all product grants on that key. Historical financial records remain available.
Expiration, a banned creator, or loss of the creator’s organization management role prevents new requests. Rejoining the organization or regaining admin status does not restore old keys. Suspended or expired organizations or resources can also block execution.
Revocation does not automatically cancel work already started or existing event subscriptions. Use the relevant product’s cancellation or pause controls when needed, and inspect the outcome in Usage and Billing.