Auth and credentials

Runtime API (SDK /sdk/v1): authenticate with the X-RAI-Agent-Key header. The SDKs send this from the api_key / apiKey you configure. Agent keys are issued for a runtime identity and are typically shown once — store them in a secrets manager.

Admin / console: operators sign in to the instance they run (Community Edition uses local bootstrap credentials — change defaults before any shared environment). Console APIs use a Bearer session/token path separate from agent keys.

Never put agent keys in frontend code, mobile apps, or public repositories. Call authorize from your application backend or trusted worker that already owns the side effect.

Community Edition note: there is no public multi-org signup. You provision systems, identities, and keys inside the instance you deploy. Hosted SaaS signup is out of scope for the open Community Edition.

Rotate keys if they leak. Prefer fail_closed integrations so a missing or revoked key cannot silently allow consequential actions.