Skip to main content
Sign in to Agent Builder and open Workspace → API & Developers → API keys. Your Labs account must have permission to manage Agent Builder API keys. Your workspace role separately determines what the key can do.

​
Create a key

  1. Select Create API key.
  2. Enter a descriptive name, such as Reporting integration.
  3. Choose an expiration: 30 days, 90 days (the default), or 365 days.
  4. Create the key and copy the secret while it is displayed. Store it in your integration’s secret manager.
The key list shows identifying information and status, not the full secret. Keep the key out of frontend code, source control, screenshots, and logs.

​
Select a workspace for requests

Open the REST API tab to find the selected Workspace ID and request examples. Send that ID in X-VOAI-ORGANIZATION-ID alongside your key in X-BW-LABS-AGENTS-API-KEY. Keys belong to your account and can access workspaces where you are currently a member, subject to your role. Creating a key while viewing one workspace does not bind it to that workspace. See workspaces and permissions.

​
Rotate a key

  1. Find the active key and select Rotate.
  2. Copy the replacement secret and update your integration.
  3. Verify a read request with the replacement.
  4. Revoke the previous key once all consumers have switched.
Rotation creates a replacement and leaves the previous key active until you revoke it. Inspect the replacement’s expiration in the key list rather than assuming a new lifetime.

​
Revoke a key

Select Revoke and confirm. Requests using that key lose access on their next request. Use Show revoked keys to include revoked entries in the list. Expired keys cannot authenticate. Create a replacement before the expiration shown in the console. Removing the owner’s workspace membership also removes their key’s access to that workspace.

​
If key management is unavailable

Continue with the REST quickstart. These keys authenticate supported REST operations; MCP uses OAuth.