API keys authenticate requests to Salambo API v1. Each key belongs to one workspace and has an explicit set of scopes.

​
Key format and modes

ModePrefixUse
Livesk_live_Normal API access for a workspace.
Testsk_test_Test-mode API access where supported.
The key prefix is stored for display and lookup. The full secret is hashed at rest and shown only once when the key is created or rotated.

​
Scopes

Scopes determine what the key can do.
ScopeUse
models:readList available active agent models.
responses:writeCreate, retrieve, and cancel responses.
files:readRead response files and file content.
agents:readList and inspect agents.
agents:writeCreate, update, archive, and run agents.
runs:readList and inspect automation runs.
runs:writeControl run execution.
env_vars:readList environment variable metadata.
env_vars:writeCreate, update, and delete environment variables.
env_vars:revealReveal secret environment variable values.
github:readRead GitHub connection status.
github:writeConnect and update GitHub authorization.
api_keys:manageCreate, rotate, and revoke API keys through the API.

​
Runtime-capable scopes

Salambo treats these scopes as runtime-capable:
  • responses:write
  • files:read
  • runs:write
Creating or rotating a key with any of those scopes checks runtime billing readiness for the workspace billing owner. Configuration-only scopes can still be used for setup flows that do not start or access runtime execution.

​
Last used timestamp

When a key successfully authenticates, Salambo updates its last_used_at timestamp on a best-effort basis. A recently used key can show a recent last-used time even if the request later fails a runtime readiness check.

​
Security practices

  • Store API keys in environment variables or a secret manager.
  • Do not commit secrets to source control.
  • Use separate keys per environment and integration.
  • Give each key only the scopes it needs.
  • Revoke keys that are no longer used.
Continue with Create an API key for the complete workspace setup and verification flow.