rebase api-key
Create, list, and revoke workspace API keys.
Synopsis
rebase api-key create <name>
rebase api-key list
rebase api-key revoke <id-or-prefix-or-name>Subcommands
| Subcommand | Description |
|---|---|
create | Create a workspace API key and print the one-time secret. |
list | List API key metadata and prefixes. |
revoke | Disable an API key. |
API key secrets start with rb_. Rebase stores only key hashes, so the full secret is shown only once during creation.
The default agent key preset includes endpoint read and execute permissions so agents can invoke default auth="api_key" endpoints.
create
Create a workspace API key.
Synopsis
rebase api-key create <name>
rebase api-key create <name> --project energy
rebase api-key create <name> --project-id <uuid>
rebase api-key create <name> --permission runs:read --permission runs:write
rebase api-key create <name> --expires-at 2026-07-01T00:00:00Z
rebase api-key create <name> --jsonArguments
| Argument | Type | Description |
|---|---|---|
<name> | str | Operator-facing key label. |
Options
| Option | Type | Description |
|---|---|---|
--project | str | Scope the key to a project by name. |
--project-id | uuid | Scope the key to an exact project ID. |
--permission | str | Permission to grant. Repeat to override the default agent preset. |
--expires-at | datetime | ISO datetime when the key expires. |
--json | bool | Print the raw create response, including the one-time api_key secret. |
Without --permission, the command creates an agent key with workspace, project, function, workflow, model, and run read permissions, plus endpoints:read and endpoints:execute.
The full secret is printed once. Store it securely; it cannot be retrieved later.
list
List workspace API keys.
Synopsis
rebase api-key list
rebase api-key list --jsonOptions
| Option | Type | Description |
|---|---|---|
--json | bool | Print machine-readable JSON output. |
Output
The table output includes name, key prefix, project ID, enabled state, usage and expiry timestamps, revoked timestamp, permissions summary, and API key ID.
The full API key secret is never shown by list.
revoke
Revoke a workspace API key.
Synopsis
rebase api-key revoke <id-or-prefix-or-name>
rebase api-key revoke <id-or-prefix-or-name> --jsonArguments
| Argument | Type | Description |
|---|---|---|
<id-or-prefix-or-name> | str | API key ID, key prefix, or unique key name. |
Options
| Option | Type | Description |
|---|---|---|
--json | bool | Print machine-readable JSON output. |
Revocation disables the key and sets revoked_at. It does not delete the key record.
If a name or prefix matches more than one key, use the exact API key ID.