> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beta.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform settings

The settings of API keys, CLI logins and webhook secrets: scopes, spend caps, expiry and rotation, with defaults and examples.

Keys, CLI logins and webhook signing secrets take a few settings of their own. A key's scopes and spend cap bound everything made with it, sandboxes' grants included.

| Setting | Default |
|---|---|
| [Key scopes](#key-scopes): `scopes` | every scope except `vision:profiles:export`, `vault:write` and `platform:write` |
| [Spend cap](#spend-cap): `spend_cap_usd` | none |
| [CLI login lifetime](#cli-login-lifetime): `expires_in_days` | 30 days |
| [CLI login scopes](#cli-login-scopes): `scopes` | what the CLI asked for, within your role |
| [Webhook secret overlap](#webhook-secret-overlap): `grace_s` | 86,400 s |

## Keys and logins

### Key scopes

What the key may call. Give an agent's key only the products it needs; `sandboxes:write`, `vault:*` and `platform:*` are granted only when named exactly.

- **Field:** `scopes` on [create key](/api/post-v1-keys)
- **Default:** every scope except `vision:profiles:export`, `vault:write` and `platform:write`
- **Values:** scope names from [Scopes](/platform#scopes), such as `vision:run` or `sandboxes:*`
- **Invalid value:** [`400 invalid_request`](/errors#invalid_request)
- **Guide:** [Scopes](/platform#scopes)

```json
{"name": "scraper", "scopes": ["vision:run", "vision:read"]}
```

```bash
b3os keys create --name scraper --scope vision:run,vision:read
```

### Spend cap

Stops the key's calls once they have spent this much. Sandboxes the key creates inherit it.

- **Field:** `spend_cap_usd` on [create key](/api/post-v1-keys)
- **Default:** none
- **Values:** 0 USD or more
- **Invalid value:** [`400 invalid_request`](/errors#invalid_request)

```json
{"name": "scraper", "scopes": ["vision:run"], "spend_cap_usd": 25}
```

```bash
b3os keys create --name scraper --scope vision:run --spend-cap-usd 25
```

### CLI login lifetime

How long the token from `b3os login` works. The approval page in the dashboard sends it; log in again for a new token, and `b3os logout` revokes the old one.

- **Field:** `expires_in_days` on the dashboard's CLI login approval
- **Default:** 30 days
- **Values:** 1 to 30 days
- **Invalid value:** [`400 invalid_request`](/errors#invalid_request)
- **Guide:** [Signing in](/platform#signing-in)

### CLI login scopes

What the token from `b3os login` may do. On the approval page, uncheck the scopes the CLI does not need.

- **Field:** `scopes` on the dashboard's CLI login approval
- **Default:** what the CLI asked for, within your role
- **Values:** scope names from [Scopes](/platform#scopes)
- **Invalid value:** [`400 invalid_request`](/errors#invalid_request)
- **Guide:** [Signing in](/platform#signing-in)

### Webhook secret overlap

After a rotation, how long the old signing secret keeps signing beside the new one, so receivers can switch without dropping deliveries.

- **Field:** `grace_s` on [rotate the webhook secret](/api/post-v1-webhooks-secret-rotate)
- **Default:** 86,400 s
- **Values:** 0 to 604,800 s
- **Invalid value:** [`400 invalid_request`](/errors#invalid_request)
- **Guide:** [Webhooks](/platform/webhooks)

```json
{"url": "https://example.com/hooks", "grace_s": 3600}
```

```bash
b3os webhooks rotate --url https://example.com/hooks --grace-s 3600
```

## Fixed in the beta

These work one way in the beta, and no request field changes them.

### Request log

**Kept 7 days.** `GET /v1/requests` lists your requests from the last 7 days.

- **Guide:** [Requests](/platform/requests)