Granular API keys
in progress
j
jamesthebaconowner
Currently, there’s no way to securely use an API key while controlling my web application. I’m developing an API to monitor the server's boot status and attempted to use the List Events feature. However, I can't keep the API key completely safe due to platform limitations. It would be beneficial to have the option to restrict the API key's access to specific actions, like only allowing it to use the List Events API.
Log In
Anurag Goel
Scoped API Keys are now in private beta on Render. Choose which actions a key can perform, without handing a CI job, agent, or integration all of your permissions.
Learn more and request access: https://render.com/blog/scoped-api-keys-private-beta
Anurag Goel
Scoped API Keys are now in private beta on Render. Choose which actions a key can perform, without handing a CI job, agent, or integration all of your permissions.
Learn more and request access: https://render.com/blog/scoped-api-keys-private-beta
Anurag Goel
Merged in a post:
for automation use api key
E
Eddy Harith
web development
Anurag Goel
Merged in a post:
API key for service
s
senavi97
for example, if i have 3 static site services: development, staging, and production, i don't want a single api key to be able to make custom domain modifications for all of them; perhaps allow specifying api key names within the service, allowing only those api key(s) to call endpoints under that service
Anurag Goel
Merged in a post:
API token scoped per workspace for SOC 2 compliance
K
Kenn Ejima
Render API keys / tokens are not per-workspace or per-org, and has access to all workspaces that I have.
Vanta, one of the most common SOC 2 compliance vendor, requires Render API key for integration, and this limitation complicates as we don't want to provide a personal API key that can access to a lot more external organizations and workspaces.
Anurag Goel
Merged in a post:
Scoped API Keys for LLM usage
T
Tom Pinchen
At the moment API keys are granted as broad access. This makes it risky to use LLM''s in a production setting (for example debugging logs).
We need to be able to generate API keys with specific read, write permissions at a repository and service level.
Anurag Goel
Merged in a post:
Scoped API keys: limit a key to specific projects, environments, or services
j
jackson ballow
Please please please let us create API keys limited to specific
projects/environments/services, with permission levels (read-only,
deploy, full).
This would be for agent controlled deployments. I run an autonomous AI agent
that should be able to deploy, read logs, and manage env vars for our
dev services, but have zero access to production. Today every API key
has full account access, so the only workaround is a separate
workspace plus a separate user account, which is clunky.
This is becoming common as more teams let AI agents handle
deployments. Scoped keys would make Render the safest place to do it.
R
Raj Phyal
An all access key is a security hazard specially if used with MCP for agents, as they can circumvent around the denies and a leak is devastating. And update on this Anurag Goel? Even readonly keys would be a great improvement. Thanks!
b
brian
Any update on this? We were expecting before now based on feedback
b
brian
At a minimum, read-only keys as well as account-level keys not dependent upon a user's account. Ideally, keys would also be scopable to specific orgs, workspaces, and resources
Anurag Goel
updated the status to
in progress
We expect to have this available in early access in Q3.
G
GearConnect Admin
Anurag Goel Great news! Thank you!
b
brian
Anurag Goel - any update? We are now in Q4
Load More
→