Docs Reference
API keys
The key scopes, narrowest first, and how far each one reaches.
Give every integration the narrowest key that does its job. A key embedded in an application should be trace_write: if it leaks, the holder can send you telemetry and nothing else.
How far each key reaches
Scopes
Keys are verified by hash; the prefix routes a key (rb_cloud_ sends to runback.dev with nothing else set) and never authenticates it. A new key from Settings expires after 90 days unless you choose otherwise.
| Scope | Prefix | Endpoints | What it can do | Where to create it |
|---|---|---|---|---|
compliance_read | rb_comp_ | 1 | Reads one thing: the aggregate regulatory evidence summary. For a third-party compliance tool; it cannot send runs, read run content or sign in. | Settings › Keys and access › Compliance evidence key |
security_findings | rb_secfind_ | 1 | Writes one thing: a security finding. Paste it into a guardrail vendor's webhook settings so its findings land in your signed audit trail. | Settings › Keys and access › Security findings key |
external_grant | rb_grant_ | 1 | An auditor's read-only, time-limited access to the audit records of the runs you grant, and nothing else. It always expires. | Settings › Keys and access › Auditor access |
trace_write | rb_cloud_rb_live_ | 4 | Sends runs and nothing else; the default for a new key, and the one to embed in an application or container image. If it leaks, the holder can send you telemetry and can read nothing. | Settings › Keys and access › API key |
scim | rb_scim_ | 4 | The token your identity provider (Okta, Entra ID) uses to create and deactivate members. It cannot send runs, read run content or sign in. | Settings › Keys and access › Directory provisioning (SCIM) |
ci | rb_cloud_rb_live_ | 44 | For the CI release gate and replay: runs evals, reads the gate verdict and replays, acting as a member. It cannot send runs or change settings. | Settings › Keys and access › API key |
ingest | rb_cloud_rb_live_ | 49 | Full API access, acting as an admin. Older keys have it; give it to a new key only where nothing narrower works. | Settings › Keys and access › API key |
The API reference shows every endpoint against any of these.