CapabilitiesKeys and secrets
Limited API keys
Create API keys that can do only some things, or only in one project.
Short answer: 9 of 16 providers offer it fully: Boat, Cloudflare Sandbox, Daytona, InstaBox, Lizard, Morph, Runtime, Sandboxer and Tensorlake. With a catch: Agent 37, Blaxel, E2B, Modal, Vercel Sandbox and boxd. Checked 29 October 2026.
Who offers it
Part of Keys and secrets, which explains why it matters.
Fully: Boat, Cloudflare Sandbox, Daytona, InstaBox, Lizard, Morph, Runtime, Sandboxer and Tensorlake. With a catch: Agent 37, Blaxel, boxd, E2B, Modal and Vercel Sandbox.
A key can be limited to a set of actions, a set of machines and an expiry date.
docs-confirmed “boat grants a request only when **both** of these are true” Source
Cloudflare's own API tokens can be limited to specific permissions and resources.
docs-confirmed “Below is a list of the available token permissions.” Source
A key can be limited to specific actions, though it can still reach every running machine in the organisation.
docs-confirmed “Sandbox runtime access is not a grantable scope. Any API key valid for an organization can address that organization's running sandboxes through the toolbox” Source
A key can be limited to reading, writing or deleting one kind of resource.
docs-confirmed “A key carries scopes: read, write and delete for each resource.” Source
A key can be limited to one project or workspace, and such a key cannot touch billing or other keys.
docs-confirmed “A scoped key works only inside its projects or workspaces.” Source
An agent token can be limited to the smallest set of actions that works.
docs-confirmed “Request the smallest scope set that works.” Source
A key can be read-only, carry a daily spend limit, and be walled off in its own compartment.
pricing-page “read-only keys, a daily spending limit per key, and compartments” Source
A request is allowed only when the key's actions and its machines both permit it.
docs-confirmed “A request is allowed only when both hold:” Source
A key belongs to one project and cannot carry organisation-wide permissions.
docs-confirmed “API keys are project-specific credentials that allow programmatic access to resources within a project.” Source
The catch: A key is limited to one workspace but can do everything in it, and there is no read-only key.
docs-confirmed “each key is scoped to one workspace” Source
The catch: A service-account key is limited to one workspace but has no narrower permissions.
docs-confirmed “a service account's API key or client-credentials token only grants access to the single workspace that service account belongs to” Source
The catch: Keys are per person and can be revoked, but there is no way to make one read-only or limit it to one machine.
inferred “API keys | 25 per user” Source
The catch: A key belongs to one team and there is no published read-only or per-machine scope.
inferred “The same API key authenticates both the SDKs and the” Source
The catch: Permissions come from a person's workspace role, not from a key that can only do one thing.
inferred “Role-Based Access Control” Source
The catch: Tokens are limited to a team, but no read-only or sandbox-only scope is published.
inferred “Manage sandboxes through the CLI, JS SDK, or Python SDK.” Source
- SpritesNot published
No key scopes are published.
inferred “CLI Authentication” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.