API keys | BoxCompute Sandbox

Manage customer API keys at https://app.boxcompute.ai/api-keys.

Create a key

Click New API key.
Keep the default name Development or enter a descriptive name for the integration or environment.
Click Create key.
Copy the bc_live_... secret using the copy control and store it immediately.

The plaintext secret is shown only once. After you close the dialog, BoxCompute shows only the key’s name, final-character hint, scopes, creation and last-use information, and revocation status. If you lose the secret, create a replacement and revoke the old key.

Store and use keys

Put production keys in a secret manager and limit who and what can read them.
Use separate, clearly named keys for development, CI, and production so each can be rotated independently.
Do not commit keys, paste them into source code, include them in URLs, or write them to logs.
Do not use a realistic-looking secret in examples. Use bc_live_REDACTED in static documentation.
Send the secret only in the HTTPS authorization header:

Authorization: Bearer bc_live_REDACTED

Scopes

Keys can have these scopes:

Scope	Permitted public v2 operations
`workspace:create`	Create a persistent workspace owned by the account
`sandbox:read`	List workspaces, active and deleted Sandboxes; inspect a Sandbox; read current and retained logs and Sandbox analytics; introspect the authenticated account and key with `GET /api/v2/me`; read file metadata and content; list directories; and revoke the current key with `DELETE /api/v2/auth`
`sandbox:create`	Create a Sandbox in an owned workspace or start an existing owned slot
`sandbox:execute`	Execute commands and manage observable operations; write, edit, rename, create, and remove paths; create and close one-hour VM browser previews; activate, reconnect, and revoke an operator-selected cooperative connection; create, look up, and revoke selected TCP service access
`sandbox:delete`	Delete an owned Sandbox
`usage:read`	Read account usage summaries, credit balance, wallet transactions, Sandbox compute-cost reports, and the account’s API audit log

Existing keys do not gain workspace:create automatically. Explicitly include that scope when creating a key for an integration that can bootstrap a workspace. A key that only uses an existing workspace does not need it. Use separate keys for separate integrations so you can rotate or revoke their access independently.

See Audit API activity to filter API requests and key lifecycle events, page through results, and understand retention. See Track Sandbox costs to attribute compute to creating keys, Sandboxes, and charged runs.

Revoke a key

Use the revoke control on the API keys page. Revocation takes effect immediately, and the secret cannot authenticate another request. Revoking a key does not delete workspaces or Sandboxes that already exist.

A key can also revoke itself:

await boxcompute.auth.revoke();

boxcompute.auth.revoke()

With direct HTTP:

curl -X DELETE 'https://api.boxcompute.ai/api/v2/auth' \
  -H 'Authorization: Bearer bc_live_REDACTED' \
  -H 'Content-Type: application/json'

The response is 204 No Content; the key is invalid immediately afterward.