# What are least-privilege API keys?

A least-privilege API key can do only what its job needs. For example, it can
read without changing anything. If the key leaks, the damage is limited.

**On Runtime, any key can be made read-only or given a daily spending limit. No
key can loosen its own terms.** A read-only key sees the whole account and
spends nothing. A limited key's agent can commit at most the sum you set in any
24 hours ([security](/docs/security#read-only-keys-and-daily-limits)).

## Why it matters for AI agents

NIST defines least privilege as restricting access "to the minimum necessary to
accomplish assigned tasks". An agent is the case this rule was written for. An
agent runs on instructions that it did not write. Text in a file or on a web
page can steer it. It acts fast and does not pause. A dashboard that only reads
should hold a key that only reads. A coding agent that creates sandboxes all
night should hold a key with a ceiling on what it can spend. Then a mistake or
an injected instruction is limited by the key, not by the whole account.

One key per agent also helps. Each key appears separately in the audit log, and
revoking one key leaves the others working.

## Runtime's key controls

| Control              | What it does                                                                                      |
| -------------------- | ------------------------------------------------------------------------------------------------- |
| Read-only key        | Sees every sandbox's state, spec and cost, images, volumes, snapshots, balance. Changes nothing.  |
| Not visible to it    | Files and command output inside sandboxes, job runs and secrets                                   |
| Daily spending limit | The most a key's agent may commit in any 24 hours, counting what running sandboxes will use       |
| Past the limit       | Create, wake, extension or renewal fails with `spending_limit_reached` (HTTP 402), with no charge |
| Per create           | `maxTotalCostMicros` stops a sandbox once it has cost that much in total                          |
| Reach                | A key acts on what it created. Only an owner or admin can create a key for the whole account.     |
| Who sets limits      | The member who made the key, or an owner or admin, on the website. No key can set its own limits. |
| Record               | Every key made, revoked or limited is in the audit log, with who did it and from where            |

Both controls are optional. They cover every Cloud product, including products
added later.

## Make and check one

From a terminal, each request opens a browser approval for an owner, admin or
developer:

```bash no-run
runtime keys create --name monitor --read-only
runtime keys create --name nightly-agent --daily-limit 25
```

Code that runs on a key can read its own terms before it starts work:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
const { access, daily } = await runtime.limits.get();
console.log(access, daily.remainingMicros); // "read", "full" or "selected"
```

```python check
from withruntime import Runtime

with Runtime() as runtime:
    limits = runtime.limits.get()
    print(limits["access"], limits["daily"]["remainingMicros"])
```

An agent connected through MCP asks the same question with `runtime_account`,
action `limits`. A client that asks for the scope `runtime:read` during MCP
sign-in gets a read-only key ([remote connection](/docs/mcp#remote-connection)).
The SDKs do not retry a `spending_limit_reached` error. The agent should stop
and tell the person it works for.

Room under a limit returns as older spending leaves the 24-hour window. A
running sandbox keeps the time it is already funded for when the limit is
reached. A sandbox whose next renewal would pass the limit stops or pauses at
that point.

## Related

- [What is a spending limit?](/glossary/spending-limit)
- [What is workload identity?](/glossary/workload-identity)
- [How to create a read-only key](/how-to/create-a-read-only-key)
- [How to set a daily spending limit](/how-to/set-a-daily-spending-limit)
- [Security](/docs/security)
- [CLI: keys for CI](/docs/cli#keys-for-ci)

## Sources

- [NIST CSRC glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege), definition from NIST SP 800-12 Rev. 1, read 25 October 2026

Facts on this page were checked on 25 October 2026.