# API Keys

Daytona API keys authenticate requests from the SDKs, the CLI, and the API to the resources in a [project](https://www.daytona.io/docs/en/v2/projects.md). To pass a key, see [authentication](https://www.daytona.io/docs/en/v2/authentication.md).

[Organization API keys](#organization-api-keys) cover organization-level operations that are not tied to a project.

Every project API key belongs to exactly one project and carries an explicit list of [permissions](#permissions--scopes); its requests are confined to both. Keys can carry an expiry. Revocation applies to new requests; a regional proxy can accept a revoked key for up to 30 seconds.

:::caution[Daytona v1 key sync]
In an organization kept in sync with Daytona v1, a key that a member creates in the default project is also copied to Daytona v1. The v1 copy can read every sandbox, snapshot, and registry in the organization, whatever the key's permissions. To keep a key off Daytona v1, set **`sync_to_v1`** to **`false`** when you create it, or update the key later.
:::

## Create an API key

Create an API key to authenticate Daytona SDK and API requests.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/keys)
2. Select the project in the header switcher
3. Click <Button>Create API Key</Button>
4. Enter a <Button>Key Name</Button>, optionally set an expiry, and [select permissions](#permissions--scopes)
5. Click <Button>Create API Key</Button>
6. Copy the API key to your clipboard and use it to authenticate requests


```bash
daytona key mint --project PROJECT_ID \
  --name my-api-key \
  --permission write:sandboxes,delete:sandboxes \
  --expires 2027-01-01T00:00:00Z
```

| **Flag**       | **Type** | **Description**                                                                 |
| -------------- | -------- | ------------------------------------------------------------------------------- |
| **`--permission`** | **`string`** | A comma-separated list of permissions.                                          |
| **`--expires`**    | **`string`** | An RFC 3339 timestamp or a Go duration such as **`720h`**, counted from now.        |

- **`daytona key mint`** prints the plaintext token once, when the key is created.


```bash
curl 'https://api.daytona.com/projects/PROJECT_ID/api-keys' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "my-api-key",
  "project_permissions": ["write:sandboxes", "delete:sandboxes"],
  "expires_at": "2027-01-01T00:00:00Z"
}'
```

```json
{
  "id": "KEY_ID",
  "name": "my-api-key",
  "project_id": "PROJECT_ID",
  "key_prefix": "dtn_...",
  "token": "YOUR_API_KEY",
  "project_permissions": ["read:sandboxes", "write:sandboxes", "delete:sandboxes"],
  "expires_at": "2027-01-01T00:00:00Z",
  "service_account_id": null
}
```

- The create response is the only response that returns **`token`**.
- Store the **`token`** value when you create the key.
- Write and delete permissions add their read counterpart, such as **`read:sandboxes`**.
- A key can hold only permissions you hold.
- Daytona refuses a request for more permissions than you hold and does not narrow the request.
- Live key names are unique per project.
- A new **`default`** or unnamed key revokes **`default`** keys older than two minutes.
- A project holds at most 100,000 live keys.


| **Field**                 | **Description**                                                                                                            |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **`name`**                | Display name for the key. Optional; defaults to **`default`**.                                                             |
| **`project_permissions`** | Required, non-empty list of [permissions](#permissions--scopes). Unknown values are rejected with **`400`** error status code. |
| **`expires_at`**          | Optional RFC 3339 timestamp in the future. Omit for a key that never expires.                                              |
| **`service_account_id`**  | Optional. Mint the key for a [service account](#service-accounts) instead of yourself. Service account keys must be named. |

## Credentials

Daytona accepts two bearer credentials, named differently in this page's API examples:

| **Credential** | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **API KEY**    | A project API key created as described above. It authenticates SDK, toolbox, and sandbox requests, and the few management routes that accept it, such as [getting the current key](#get-the-current-api-key). This is the credential the SDKs and the **`DAYTONA_API_KEY`** variable carry. See [authentication](https://www.daytona.io/docs/en/v2/authentication.md) for how to pass it to the SDKs, the CLI, and API requests.                                                                                             |
| **OIDC TOKEN** | The session token of a signed-in user (an OIDC bearer JWT, the credential the dashboard uses). Management routes that act on behalf of a person require it and reject API keys with **`401`**: creating, listing, and revoking keys, service accounts, [organizations](https://www.daytona.io/docs/en/v2/organizations.md), [projects](https://www.daytona.io/docs/en/v2/projects.md), and [billing](https://www.daytona.io/docs/en/v2/billing.md). Obtain it by signing in with the dashboard or **`daytona login`**; the CLI commands in those sections use the saved session for you. |

[Organization API keys](#organization-api-keys) (`dtno_...`) are a third kind, scoped to an organization rather than a project; that section lists the scopes they can hold.

## Permissions & Scopes

| **Resource**       | **Scope**               | **Description**                                                    |
| ------------------ | ----------------------- | ------------------------------------------------------------------ |
| Sandboxes          | **`read:sandboxes`**    | View sandboxes and use the toolbox                                 |
|                    | **`write:sandboxes`**   | Create/modify sandboxes                                            |
|                    | **`delete:sandboxes`**  | Delete sandboxes                                                   |
| Snapshots          | **`read:snapshots`**    | View [snapshots](https://www.daytona.io/docs/en/v2/snapshots.md)                               |
|                    | **`write:snapshots`**   | Create/modify snapshots                                            |
|                    | **`delete:snapshots`**  | Delete snapshots                                                   |
| Images             | **`read:images`**       | View [images](https://www.daytona.io/docs/en/v2/images.md)                                     |
|                    | **`write:images`**      | Create/modify images                                               |
|                    | **`delete:images`**     | Delete images                                                      |
| Registries         | **`read:registries`**   | View [registries](https://www.daytona.io/docs/en/v2/registries.md)                             |
|                    | **`write:registries`**  | Create/modify registries                                           |
|                    | **`delete:registries`** | Delete registries                                                  |
| Secrets            | **`read:secrets`**      | View [secrets](https://www.daytona.io/docs/en/v2/secrets.md)                                   |
|                    | **`write:secrets`**     | Create/modify secrets                                              |
|                    | **`delete:secrets`**    | Delete secrets                                                     |
| Spending           | **`read:spending`**     | View project spending                                              |
| Limits             | **`read:limits`**       | View project limits (reserved)                                     |
| Runners            | **`read:runners`**      | View runners (reserved) |

## Operations

### List API keys

List the API keys of a project. The list never contains tokens and contains only live keys. Daytona deletes revoked and expired keys 7 days after they stop working.


```bash
daytona key list --project PROJECT_ID
```


```bash
curl 'https://api.daytona.com/projects/PROJECT_ID/api-keys' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

```json
{
  "project_api_keys": [
    {
      "id": "KEY_ID",
      "name": "my-api-key",
      "key_prefix": "dtn_...",
      "created_at": "2026-09-10T12:00:00Z",
      "revoked_at": null,
      "last_used_at": "2026-09-11T08:30:00Z",
      "project_permissions": ["read:sandboxes", "write:sandboxes", "delete:sandboxes"],
      "expires_at": "2027-01-01T00:00:00Z",
      "service_account_id": null,
      "service_account_name": null
    }
  ],
  "next_cursor": null
}
```

- You can revoke a key you minted with **`write:project_api_keys`** alone.


### Get by ID


```bash
curl 'https://api.daytona.com/projects/PROJECT_ID/api-keys/KEY_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Get the current API key

Get the API key that authenticates the request, including the project and organization it acts in and the permissions it carries. The response never contains the token.


```python
from daytona import Daytona

daytona = Daytona()
key = daytona.v2.current_api_key()
print(key.name, key.context.project_name, key.context.org_name)
print(key.project_permissions)
```


```typescript
import { Daytona } from '@daytona/sdk'

const daytona = new Daytona()
const key = await daytona.v2.currentApiKey()
console.log(key.name, key.context.project_name, key.context.org_name)
console.log(key.project_permissions)
```


```bash
curl 'https://api.daytona.com/api-keys/current' \
  --header 'Authorization: Bearer YOUR_API_KEY'
```

- **`/api-keys/current`** takes a project API key, not a token from [exchange a token](#exchange-a-token).
- Daytona updates **`last_used_at`** periodically, so **`last_used_at`** can lag the request that reads it.


### Exchange a token

Exchange a signed-in user's session token for a short-lived access token scoped to one project. The access token carries the user's own permissions in that project and authenticates workload requests in place of a project API key. Organization API keys cannot be exchanged.


```bash
curl 'https://api.daytona.com/auth/token' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token": "YOUR_OIDC_TOKEN",
  "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "project_id": "PROJECT_ID"
}'
```

```json
{
  "access_token": "eyJ...",
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 300
}
```

| **Field**            | **Type** | **Description**                                                                                                     |
| -------------------- | -------- | ------------------------------------------------------------------------------------------------------------------- |
| **`grant_type`**         | string   | Required. **`urn:ietf:params:oauth:grant-type:token-exchange`**.                                                        |
| **`subject_token`**      | string   | Required. Must be the same token as the bearer in the **`Authorization`** header; otherwise the request returns **`400`**. |
| **`subject_token_type`** | string   | Required. **`urn:ietf:params:oauth:token-type:access_token`** or **`urn:ietf:params:oauth:token-type:jwt`**.                |
| **`project_id`**         | string   | Required. The project the access token is scoped to. An unknown project, or one you are not a member of, returns **`404`**. |

- The request also accepts the fields form-encoded.
- **`expires_in`** is the access token lifetime in seconds.
- Exchange again for a new access token when the current access token expires.
- The request must omit **`scope`** and **`resource`**.
- The access token cannot be narrowed below your permissions.


### Revoke an API key

Revoke an API key. Revocation cannot be undone. New requests made with the key fail, except at a regional proxy, which can accept the key for up to 30 seconds after revocation. Daytona deletes the revoked key 7 days later.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/keys)
2. Click <Button>Revoke</Button> next to the API key you want to revoke
3. Confirm the revocation


```bash
daytona key revoke KEY_ID
```


```bash
curl 'https://api.daytona.com/projects/PROJECT_ID/api-keys/KEY_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

- Revoking a key requires **`delete:project_api_keys`**.
- Revoking a key you minted requires only **`write:project_api_keys`**.
- Revoking a key owned by a service account requires **`delete:service_accounts`** instead.


## Service accounts

Service accounts are non-human identities in your organization. Use them to own API keys for automation so that the keys are not tied to a person's membership.

### Create a service account


```bash
daytona service-account create my-service-account --role developer --org ORG_ID
```

| **Flag** | **Type** | **Description**                       |
| -------- | -------- | ------------------------------------- |
| **`--role`** | **`string`** | A comma-separated list of role slugs. |


```bash
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "my-service-account",
  "roles": ["developer"]
}'
```

| **Field**     | **Type**   | **Description**                                                                                                                 |
| ------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **`name`**        | **`string`**   | Required. At most 64 letters, digits, **`-`**, or **`_`**, unique in the organization.                                                  |
| **`description`** | **`string`**   | Optional, up to 512 characters.                                                                                                 |
| **`roles`**       | **`string[]`** | Required. Must hold at least one role. The **`admin`** role is refused, and every permission the roles grant must be one you hold yourself. |

- Personal organizations cannot have service accounts.
- An organization holds at most 500 live service accounts.


### Create a service account key

Create an API key owned by a service account. The key keeps working when its creator leaves the organization. Outside the default project, the service account must first be [added to the project](https://www.daytona.io/docs/en/v2/projects.md#add-project-service-accounts), and the key can carry only permissions you and the service account both hold.

1. Go to [Daytona Dashboard ↗](https://app.daytona.com/dashboard/keys)
2. Click <Button>Create API Key</Button>
3. Under <Button>Owner</Button>, select the service account
4. Enter a <Button>Key Name</Button>, [select permissions](#permissions--scopes), and click <Button>Create API Key</Button>


```bash
daytona key mint --project PROJECT_ID \
  --name my-service-account-key \
  --permission write:sandboxes \
  --service-account SERVICE_ACCOUNT_ID \
  --org ORG_ID
```


```bash
curl 'https://api.daytona.com/projects/PROJECT_ID/api-keys' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "my-service-account-key",
  "project_permissions": ["write:sandboxes"],
  "service_account_id": "SERVICE_ACCOUNT_ID"
}'
```

- Creating a service account key requires **`write:service_accounts`** in addition to **`write:project_api_keys`**.


### List service accounts


```bash
daytona service-account list --org ORG_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Get a service account


```bash
daytona service-account get SERVICE_ACCOUNT_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts/SERVICE_ACCOUNT_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


### Update a service account

Update a service account's name, description, or roles. Fields you leave out stay unchanged, and new roles replace the whole role set. When the new roles are narrower, Daytona revokes the account's project API keys that exceed them.


```bash
# The CLI updates the name (--name) and roles (--role); it cannot set the description
daytona service-account update SERVICE_ACCOUNT_ID --role maintainer
```


```bash
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts/SERVICE_ACCOUNT_ID' \
  --request PATCH \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "description": "CI runner",
  "roles": ["maintainer"]
}'

# Preview the change without applying it: { "revoked_api_keys": ..., "revoked_preview_grants": ... }
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts/SERVICE_ACCOUNT_ID/update-preview' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "roles": ["maintainer"]
}'
```

- The request requires at least one of **`name`**, **`description`**, or **`roles`**.


### Archive a service account

Archive a service account. This revokes every project API key it owns. An archived account cannot be updated, added to projects, or given new keys, and lists do not contain it.


```bash
daytona service-account delete SERVICE_ACCOUNT_ID
```


```bash
curl 'https://api.daytona.com/orgs/ORG_ID/service-accounts/SERVICE_ACCOUNT_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```


## Organization API keys

Organization API keys authenticate organization-level operations that are not tied to a project.

| **Resource**        | **Scope**                                                     | **Description**                             |
| ------------------- | ------------------------------------------------------------- | ------------------------------------------- |
| Audit logs          | **`read:audit`**                                              | View [audit logs](https://www.daytona.io/docs/en/v2/audit-logs.md)      |
| Billing             | **`read:billing`**, **`write:billing`**                       | View and manage [billing](https://www.daytona.io/docs/en/v2/billing.md) |
| SSO                 | **`read:sso`**, **`write:sso`**                               | View and manage [SSO](https://www.daytona.io/docs/en/v2/sso.md)         |
| BYOC infrastructure | **`read:regions`**, **`write:regions`**, **`delete:regions`** | View and manage [regions](https://www.daytona.io/docs/en/v2/regions.md) |
|                     | **`write:runners`**, **`delete:runners`**                     | Register and remove runners                 |


```bash
# Create
daytona org-key mint --org ORG_ID --name my-org-key --permission read:audit

# List
daytona org-key list --org ORG_ID

# Revoke
daytona org-key revoke KEY_ID
```

| **Flag** | **Type** | **Description** |
| -------- | -------- | --------------- |
| **`--name`** | **`string`** | Required.       |

- **`daytona org-key mint`** prints the plaintext token once, at creation.
- **`daytona org-key revoke`** asks for confirmation before it revokes the key.


```bash
# Create
curl 'https://api.daytona.com/orgs/ORG_ID/api-keys' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "my-org-key",
  "org_permissions": ["read:audit"]
}'

# List
curl 'https://api.daytona.com/orgs/ORG_ID/api-keys' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

# Revoke
curl 'https://api.daytona.com/orgs/ORG_ID/api-keys/KEY_ID' \
  --request DELETE \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'
```

| **Field**         | **Type**   | **Description**                                              |
| ----------------- | ---------- | ------------------------------------------------------------ |
| **`name`**            | **`string`**   | Required.                                                    |
| **`org_permissions`** | **`string[]`** | Required. A non-empty list of scopes from the table above.   |
| **`expires_at`**      | **`string`**   | Optional. Must be in the future.                             |

- The create response contains the plaintext **`dtno_`** token.
- Daytona returns the **`dtno_`** token only once.
- Creating an organization API key requires **`write:org_api_keys`**.
- Listing organization API keys requires **`read:org_api_keys`**.
- Revoking an organization API key requires **`delete:org_api_keys`**.
- An organization caps live organization API keys at 100,000.