Agent keys - Claros

Keys look like clr_<prefix>_<secret>. Only a SHA-256 hash is stored, and the web app shows the key once.

Get one

From the CLI: npx getclaros signs you in and saves a key (Device sign-in).
From the web app: Account → Agent keys (/account/keys) → name it (for example “CI runner”) → Create key → copy it now. Any member can make one for themselves; members see only their own keys, editors and admins see all.
During the preview, we also issue keys on request.

Use it

export CLAROS_KEY=clr_...      # the guard and the browser hooks read this
# where your Claros server is (or your own URL, if you self-host)
export CLAROS_URL=$(curl -s https://claros.sh/.well-known/claros.json | jq -r .api)
curl -X POST $CLAROS_URL/v1/check \
  -H "Authorization: Bearer $CLAROS_KEY" -H "content-type: application/json" \
  -d '{"app": "crm", "tool": "update_deal", "state": {"discount_pct": 45}}'

An agent key can: check actions (/v1/check*), register tools and read their kinds, use the MCP server, read rule sets and export SKILL.md. It can’t read the check log or change mappings and rules.

Revoke

Revoke on the keys page. Revoking a key kills the session tokens it minted. Only agent keys are managed in the web app; other scopes are made by an operator on the server.

See which key you’re using

npx getclaros status
curl $CLAROS_URL/v1/whoami -H "Authorization: Bearer $CLAROS_KEY"

/v1/whoami returns the workspace, the key’s prefix and scopes, never the key.