An API key says who is calling. A warrant says what may be done, how much, and until when. For an autonomous agent, the difference is the whole ballgame.
| API key | Warrant | |
| Scope | all-or-nothing | exact resources & actions |
| Spend cap | none | cumulative, enforced |
| Expiry | until rotated | built in |
| Delegation | copy the key (!) | attenuate (only narrows) |
| If stolen | full access | holder-bound = useless |
| Revoke one task | rotate (breaks everyone) | revoke by id (cascades) |
Keep your API key server-side to issue warrants; give agents only the warrants. Your key never leaves your infrastructure; agents only ever hold narrow, expiring authority. See API keys for agents.
Free to self-host. 10,000 free decisions on the hosted gateway — no card.
Get an API key Read the docs