API Keys

​

Overview

• Automated Testing: Running simulations as part of your deployment pipeline
• Integration Scripts: Connecting OneRun to other tools and platforms
• Batch Operations: Managing multiple agents or simulations programmatically
• Monitoring Systems: Automated evaluation of agent performance

​

Creating API Keys

​

Generate an API Key

openssl rand -base64 32

​

Configure the API Key

​

1. API Deployment

# In your API .env file or environment configuration
AUTH_API_KEY=your-generated-base64-key-here

​

2. Agent Worker Deployment

# In your worker .env file or environment configuration  
ONERUN_API_KEY=your-generated-base64-key-here

​

Using API Keys

​

Environment Variables

export ONERUN_API_KEY=your-api-key-here

​

cURL Example

curl -H "x-api-key: your-api-key-here" \
     -X POST \
     -H "Content-Type: application/json" \
     -d '{
       "agent_id": "prod-agent-v1",
       "scenario": "Daily health check evaluation",
       "target_conversations": 10
     }' \
     https://api.onerun.ai/v1/simulations

​

SDK Example

# Python SDK example
import os
from onerun import Client

client = Client(
    base_url=os.getenv('ONERUN_API_BASE_URL'),
    api_key=os.getenv('ONERUN_API_KEY')
)
simulation = client.simulations.create(
    agent_id="prod-agent-v1",
    scenario="Daily health check evaluation",
    target_conversations=10
)

​

Key Management

​

Key Rotation

1. Generate New Key: Create a new secure base64 key using the methods above
2. Update Environment: Replace the API key value in both deployments:
   • Update AUTH_API_KEY in your API service environment
   • Update ONERUN_API_KEY in your agent worker environment
3. Restart Services: Restart both OneRun services to pick up the new key
4. Update Clients: Update any applications using the old key

​

API Key Security

​

Best Practices

• Secure Generation: Use cryptographically secure random generation with at least 32 bytes
• Environment Variables: Store the API key in environment variables, never in code
• Regular Rotation: Generate and deploy new keys periodically for security
• Secure Storage: Use secure key management systems in production environments
• Access Control: Limit access to the environment where the API key is configured

​

Storage Guidelines

​

Troubleshooting

​

Authentication Errors

• Verify API key is correct and properly formatted
• Check that the key hasn’t been revoked or expired
• Ensure proper Authorization header format

• Confirm the API key has permission for the requested resource
• Check if the key is associated with the correct project