cs keys

cs keys manages your member API keys. A key acts as the member who created it — same connections — and is what belongs in a configuration file that outlives a session. It holds no organization permissions unless you give it some, and never more than you hold. How member and agent keys differ is on Authentication.

Usage

cs keys create <name> [--permission <slug>]…   # mints an sk-cs- key; the secret is shown once
cs keys list
cs keys rotate <id>     # new secret under a new id; name, cap, and usage carry over
cs keys revoke <id>

create

cs keys create mints a key named <name> and prints the secret once. Save it now; it cannot be shown again.

API key created (shown once — save it now):

  sk-cs-…

  id: 0199a4c2-7b2d-7c58-9e11-0d6f2a8b4c73
  permissions: (none)

--permission <slug> gives the key an organization permission. Repeat it for more than one; --permission=<slug> works too. You can give only what you hold yourself — cs whoami lists it as your key ceiling.

cs keys create ops --permission keys:org --permission agents:manage

A slug you do not hold is refused, and nothing is minted:

Error: you do not hold billing:manage, so a key cannot carry it; `cs whoami` lists what you hold (HTTP 403 ceiling_exceeded)

The CLI creates keys without a spend cap or expiry. Set either in Dashboard → API keys, where the key dialog also offers the permissions.

list

cs keys list prints the API response as JSON: a data array of keys with id, name, the last four characters, the permissions it carries, spend cap, lifetime and current-month usage, expiry, and timestamps — never the secret.

cs keys list | jq '.data[] | {id, name, last_4, permissions}'

rotate

cs keys rotate <id> revokes the key and mints a replacement under a new id, carrying over the name, permissions, spend cap, usage, and expiry. The old secret stops working immediately; the new secret and id are printed once as JSON, so update anything that references the old id. Rotation is a mint: a key that carries a permission you do not hold answers ceiling_exceeded, and only someone who holds it can rotate the key. You can still revoke it.

revoke

cs keys revoke <id> invalidates the key. Requests that still carry it answer 401 invalid_api_key.