API Keys & Security

API keys are like digital passwords that let your agent talk to other services. Here's everything you need to know about getting them, using them, and keeping them secure.

The Basics

What's an API key? It's a string of letters and numbers that identifies your agent to other services. Think of it as a membership card for each service.

Why do I need them? Your agent uses API keys to access services on your behalf — like checking your GitHub repos or deploying to Vercel.

Are they secure? Yes! We encrypt all your API keys before storing them. Even our team can't see your actual keys.

Getting API Keys

🧠 Anthropic (Required)

This is the brain of your agent. You definitely need this one.

**Where to get it**: console.anthropic.com

Steps:

5. Copy the key (starts with sk-ant-)

Cost: Pay-as-you-go based on usage. Expect $10-50/month depending on how chatty you are.

Permissions: The key gives full access to Claude API. Keep it secret!

🐙 GitHub

For repository management, code operations, and issue tracking.

**Where to get it**: github.com/settings/tokens

Steps:

- repo (full repo access)

- user:email (access email addresses)

- workflow (update GitHub Action workflows)

Cost: Free for public repos, paid plans for private repos

Permissions: Only gives access to repos and basic profile info

▲ Vercel

For deploying web applications and static sites.

**Where to get it**: vercel.com/account/tokens

Steps:

Cost: Free tier available, paid plans for more features

Permissions: Can deploy and manage your Vercel projects

🚀 Render

For cloud service management and monitoring.

**Where to get it**: dashboard.render.com/account

Steps:

Cost: Free tier available, pay for resources you use

Permissions: Can manage your Render services

⛓️ EVM Wallet Setup

For Ethereum blockchain interactions. This one's different — instead of an API key, you'll provide a private key or seed phrase.

Options:

1. Private Key: Export from MetaMask or another wallet

2. Seed Phrase: Your 12/24 word recovery phrase

3. New Wallet: Generate a fresh wallet just for your agent

Steps for MetaMask private key:

5. Copy the private key (starts with 0x)

Security note: Only use a wallet you're comfortable with. Consider creating a separate wallet just for your agent.

🌐 Namecheap

For domain registration and DNS management.

**Where to get it**: ap.www.namecheap.com/settings/tools/apiaccess/

Steps:

4. Whitelist your IP address (or use 0.0.0.0/0 for any IP)

Cost: Free with domain purchases

Permissions: Can manage your domains and DNS

📊 Polymarket

For prediction market trading.

Currently: Polymarket doesn't have a public API yet, but we're ready for when they do!

What you'll need: Polymarket account and API access (when available)

Security Best Practices

Principle of Least Privilege

Only give plugins the permissions they actually need:

- GitHub: Don't give admin access if you only need to read repos

- Vercel: Scope to specific teams if possible

- Crypto wallets: Use a separate wallet with limited funds

API Key Hygiene

Do:

Don't:

How We Protect Your Keys

Encryption at rest: All API keys are encrypted using AES-256 before being stored in our database.

Encryption in transit: Keys are sent over secure HTTPS connections only.

Zero-knowledge: Our team cannot see your actual API keys, even if we wanted to.

Secure deletion: When you remove a key, it's completely purged from our systems.

Audit logs: We log when keys are used (but not the keys themselves).

Managing Your Keys

Adding Keys to Your Agent

During setup: Add keys when creating your agent in the onboarding flow.

After setup:

Updating Keys

If you need to change a key:

Your agent will start using the new key immediately.

Revoking Keys

If a key gets compromised:

1. Immediately revoke it in the original service

Troubleshooting API Keys

"Invalid API key" errors

Check:

Permissions errors

GitHub: Make sure you selected the right scopes when creating the token

Vercel: Verify the key has access to the team/projects you need

Others: Check service documentation for required permissions

Keys not being accepted

**Format issues**: Some keys have specific formats (GitHub starts with ghp_, Anthropic with sk-ant-)

Whitelist issues: Some services (like Namecheap) require IP whitelisting

Account issues: Make sure your account with the service is in good standing

Cost Management

Monitoring Usage

Most services provide usage dashboards:

- **Anthropic**: console.anthropic.com → Usage

- GitHub: Settings → Billing

- Vercel: Dashboard → Usage

- Others: Check their billing/usage sections

Setting Limits

Anthropic: Set monthly spending limits in your account

Others: Many services have usage alerts you can enable

Optimizing Costs

For Anthropic:

For others:

What's Next?

Now that you've got your keys sorted:

- Install some plugins to make your agent useful

- Try customizing your agent's personality

- Check out our troubleshooting guide if you run into issues

Your keys are secure, your agent is powerful, and you're ready to automate all the things! 🔐✨