# What are least-privilege API keys?

A least-privilege API key can do only what its one job needs, such as reading without changing, so a leaked key does less harm.

**On Runtime any key can be made read-only or given a daily spending limit, and
no key can loosen its own terms.** A read-only key sees the whole account and
spends nothing; a limited key's agent can commit at most the sum you set in any
24 hours ([security](/docs/security#read-only-keys-and-daily-limits)).

## Why it matters for AI agents

NIST defines least privilege as restricting access "to the minimum necessary to
accomplish assigned tasks". An agent is the case the rule was written for. It
runs on instructions it did not write, it can be steered by text in a file or a
web page, and it acts fast and without pause. A dashboard that only reads
should hold a key that only reads. A coding agent that creates sandboxes all
night should hold a key with a ceiling on what it can spend. Then a mistake or
an injected instruction is bounded by the key, not by the account.

One key per agent helps too. Each shows up separately in the audit log, and
revoking one leaves the others working.

## Runtime's key controls

| Control              | What it does                                                                                    |
| -------------------- | ----------------------------------------------------------------------------------------------- |
| Read-only key        | Sees every sandbox's state, spec and cost, images, volumes, snapshots, balance; changes nothing |
| Not visible to it    | Files and command output inside sandboxes, job runs and secrets                                 |
| Daily spending limit | The most a key's agent may commit in any 24 hours, settled charges plus money on hold           |
| Past the limit       | Create, wake, extension or renewal fails with `spending_limit_reached` (HTTP 402), no charge    |
| Per create           | `maxCostMicros` refuses a create whose first lease would cost more                              |
| Who sets limits      | The member who made the key, or an owner or admin, on the website; no key can                   |
| Record               | Every key made, revoked or limited is in the audit log, with who and from where                 |

Both controls are optional, and they cover every Cloud product, including
products added later.

## Make and check one

From a terminal, each request opens a browser approval for an owner, admin or
developer:

```bash no-run
runtime keys create --name monitor --read-only
runtime keys create --name nightly-agent --daily-limit 25
```

Code running on a key can read its own terms before it starts work:

```ts check
import { Runtime } from "withruntime";

const runtime = new Runtime();
const { access, daily } = await runtime.limits.get();
console.log(access, daily.remainingMicros); // "read", "full" or "selected"
```

```python check
from withruntime import Runtime

with Runtime() as runtime:
    limits = runtime.limits.get()
    print(limits["access"], limits["daily"]["remainingMicros"])
```

An agent connected through MCP asks the same with `runtime_limits_get`. A
client that asks for the scope `runtime:read` during MCP sign-in gets a
read-only key ([remote connection](/docs/mcp#remote-connection)). A
`spending_limit_reached` error is not retried by the SDKs: the agent should
stop and tell the person it works for.

Room under a limit comes back as older spending leaves the 24-hour window. A
running sandbox keeps its current lease when the limit is reached; one that
needs a renewal past it stops or pauses when its lease ends.

## Related

- [What is a spending limit?](/glossary/spending-limit)
- [What is workload identity?](/glossary/workload-identity)
- [How to create a read-only key](/how-to/create-a-read-only-key)
- [How to set a daily spending limit](/how-to/set-a-daily-spending-limit)
- [Security](/docs/security)
- [CLI: keys for CI](/docs/cli#keys-for-ci)

## Sources

- [NIST CSRC glossary: least privilege](https://csrc.nist.gov/glossary/term/least_privilege), definition from NIST SP 800-12 Rev. 1, read 25 September 2026

Facts on this page were checked on 25 September 2026.