Runtime API keys
Create, scope, rotate, edit, and revoke programmable identities for ingest and query runtime access.
A runtime API key is a programmable project identity. It can have ingest capability, query capability, or both.
Create a key
Open Access → API Keys → New API key. The guided form separates identity, capabilities, resource access, network restrictions, and final review.
Choose:
- a descriptive name;
- at least one capability;
- allowed data models for ingest;
- allowed Analytics APIs for query;
- optional source CIDRs.
The console shows the secret once in a confirmation dialog. Copy it immediately into a secret manager. Closing the dialog returns to the key list.
Capabilities
| Capability | Allows |
|---|---|
| Ingest | Writing selected data models |
| Query | Executing selected Analytics APIs |
A key with both capabilities still uses separate resource lists. Avoid dual-capability keys unless the same application genuinely needs both paths.
Network restrictions
allowed_ips accepts IP/CIDR restrictions. An empty list means no IP restriction, not deny-all.
Edit a key
You can update the name, capabilities, model/analytics access, and network restrictions. Editing policy does not reveal or replace the existing secret.
Usage information
The detail view includes status, effective access, last source IP where available, and last_used_at. Last-used time is derived from usage rollups to avoid writing the relational database on every runtime request.
Revoke or delete
The key detail page requires confirmation before revocation. Treat revocation as an application outage unless a replacement credential has already been deployed.
/management/v1/runtime-api-keys/management/v1/runtime-api-keys/{id}/management/v1/runtime-api-keys/{id}Public browser clients
The Ingest and Query runtime endpoints permit cross-origin browser requests. When an application intentionally places a Runtime API Key in browser code, that key is no longer confidential. Use a separate key with one capability, the smallest possible model or Analytics allowlist, and no authority shared with server workloads. CORS enables browser connectivity; it does not replace runtime authentication, authorization, validation or quota enforcement.
Runtime API Keys use Authorization: ApiKey rp_ak_.... Do not send an rp_ak
key with the Bearer scheme; Bearer runtime credentials are parsed as JWTs.