Skip to main content
An agent key (ak_ntl_*) is a credential bound to one Agent. A request made with it is that agent. Give it to an agent runtime; it carries the same verified binding as an agent-scoped MCP OAuth grant. An API key is the party-wide counterpart: it can attribute a call to an agent, but it isn’t one. An agent key is scoped to its agent, nothing else.

​
Issuing

Agent keys can only be issued, rotated, or revoked from a user session, so a leaked party key can’t mint agent identities.

​
Rotation and revocation

Rotating issues a replacement and keeps the old key valid for a grace period you choose, up to 24 hours, so a running agent switches over without downtime. Revoking invalidates a key immediately, with no replacement. Either way, the secret is shown once.