Credentials & Keys

AgentOps has exactly two kinds of API key. There is no separate SDK auth — the SDK reuses these.

Operator key — sk_

• Belongs to a human / platform operator.
• Used for fleet management: createAgent, attachTradingFlow, revokeAgent, getDecision.
• Keep it server-side. Never ship it into an agent process or a browser.

Agent key — ag_

• Belongs to a single agent. Issued when you call createAgent.
• Used only to authorize payments and actions for that one agent.
• Scoped to that agent’s policy — it cannot manage the fleet.

Not an API key: the delegated key

Each agent also has a Casper delegated key — a keypair held in the key vault that signs on-chain on your behalf. It is never sent to you, never used for API auth, and never held by the agent process. It is granted and revoked with your master wallet, not rotated from Settings. See Delegated Keys.

And your master key never touches AgentOps at all. It stays in your wallet; the server only ever hands it unsigned deploys to sign.

One client, one key

The server scopes sk_ and ag_ routes separately, and each SDK client instance carries one key. If your code both manages agents and authorizes on their behalf, construct two clients.