API Keys

Settings → API Keys is where you create and revoke the org-scoped deploy API keys the CLI authenticates with.

What a key is

A deploy API key is a long-lived, org-scoped credential of the form urun_sk_ followed by 43 base64url characters. It grants the holder the ability to deploy and operate apps in your org. Each key has an id (key_id) you'll see echoed by urun login.

The launch-agents permission

Reads and the audited write surface work with any org key. The costly agent-launch actions — urun dev-gate and its MCP twin run_dev_gate — also require the launch-agents permission (api_keys.can_launch_agents) on the key.

Keys whose creator currently holds an org admin or owner role always have it — this is checked dynamically, so it can change if the creator's role changes later. For other members' keys it is granted per key in the console (Settings → API Keys) — so you can hand an agent a key that may launch server-side agents without making its owner an org admin, or withhold it from keys that should only deploy and inspect.

When to use it

• Vend a key to a developer so they can urun login.
• Provision a key for CI to run urun deploy (store it as a secret, set URUN_API_KEY).
• Rotate or revoke a key that may have leaked.