Platform settings

Keys, CLI logins and webhook signing secrets take a few settings of their own. A key's scopes and spend cap bound everything made with it, sandboxes' grants included.

Keys and logins

Key scopes

What the key may call. Give an agent's key only the products it needs; sandboxes:write, vault:* and platform:* are granted only when named exactly.

• Field: scopes on create key
• Default: every scope except vision:profiles:export, vault:write and platform:write
• Values: scope names from Scopes, such as vision:run or sandboxes:*
• Invalid value: 400 invalid_request
• Guide: Scopes

json
{"name": "scraper", "scopes": ["vision:run", "vision:read"]}

bash
b3os keys create --name scraper --scope vision:run,vision:read

Spend cap

Stops the key's calls once they have spent this much. Sandboxes the key creates inherit it.

• Field: spend_cap_usd on create key
• Default: none
• Values: 0 USD or more
• Invalid value: 400 invalid_request

json
{"name": "scraper", "scopes": ["vision:run"], "spend_cap_usd": 25}

bash
b3os keys create --name scraper --scope vision:run --spend-cap-usd 25

CLI login lifetime

How long the token from b3os login works. The approval page in the dashboard sends it; log in again for a new token, and b3os logout revokes the old one.

• Field: expires_in_days on the dashboard's CLI login approval
• Default: 30 days
• Values: 1 to 30 days
• Invalid value: 400 invalid_request
• Guide: Signing in

CLI login scopes

What the token from b3os login may do. On the approval page, uncheck the scopes the CLI does not need.

• Field: scopes on the dashboard's CLI login approval
• Default: what the CLI asked for, within your role
• Values: scope names from Scopes
• Invalid value: 400 invalid_request
• Guide: Signing in

Webhook secret overlap

After a rotation, how long the old signing secret keeps signing beside the new one, so receivers can switch without dropping deliveries.

• Field: grace_s on rotate the webhook secret
• Default: 86,400 s
• Values: 0 to 604,800 s
• Invalid value: 400 invalid_request
• Guide: Webhooks

json
{"url": "https://example.com/hooks", "grace_s": 3600}

bash
b3os webhooks rotate --url https://example.com/hooks --grace-s 3600

Fixed in the beta

These work one way in the beta, and no request field changes them.

Request log

Kept 7 days. GET /v1/requests lists your requests from the last 7 days.

• Guide: Requests