Resolved Provider Keys

When a session boots, Runtime picks the right credential for the chosen agent in this order:

Org enforced shared key - when the organization has a key configured and policy="enforced".
User’s org-scoped personal key - when the caller has saved a key against the current organization.
User’s pure-personal key - the caller’s account-wide key.
None - the session prompts for a key (or fails if the agent does not support prompting).

This page covers two surfaces:

The resolved endpoints for Anthropic and OpenAI, which return what the resolution above would produce without exposing the actual key value.
The generic provider key endpoints used for the additional agents (Cursor, Devin, Gemini, Copilot), which support the same personal/org + resolution model.

All endpoints on this page only return masked previews and metadata - values are never returned.

Anthropic resolved key

GET /api/user/anthropic-key/resolved

Required scope: integrations:read

Returns the Anthropic key that would be used to start a session right now, without exposing the key value.

Headers

string

required

Bearer <your_api_key>

string

Optional. Includes org-shared and user-scoped-org keys in the resolution.

Response

boolean

true when a key would be available; false when the session would prompt.

string

Where the resolved key came from. One of "org" (enforced shared key), "user_org" (caller’s key for this org), "user" (caller’s pure-personal key), or "none" when has_key is false.

string

Masked preview of the resolved key, or null.

curl -X GET "https://app.runtm.com/api/cloud/user/anthropic-key/resolved" \
  -H "Authorization: Bearer runtm_xxx" \
  -H "X-Organization-Id: org_abc123"

import requests

response = requests.get(
    "https://app.runtm.com/api/cloud/user/anthropic-key/resolved",
    headers={
        "Authorization": "Bearer runtm_xxx",
        "X-Organization-Id": "org_abc123",
    },
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/anthropic-key/resolved",
  {
    headers: {
      Authorization: "Bearer runtm_xxx",
      "X-Organization-Id": "org_abc123",
    },
  },
);
console.log(await response.json());

{
  "has_key": true,
  "source": "org",
  "key_preview": "sk-ant-***WxYz"
}

{
  "has_key": true,
  "source": "user",
  "key_preview": "sk-ant-***mnop"
}

{
  "has_key": false,
  "source": "none",
  "key_preview": null
}

OpenAI resolved key

GET /api/user/openai-key/resolved

Required scope: integrations:read

Identical resolution behavior to the Anthropic endpoint, returning the OpenAI key that would be used to start a Codex (or other OpenAI-backed) session right now.

Headers

string

required

Bearer <your_api_key>

string

Optional.

Response

Same shape as /api/user/anthropic-key/resolved.

curl -X GET "https://app.runtm.com/api/cloud/user/openai-key/resolved" \
  -H "Authorization: Bearer runtm_xxx"

import requests

response = requests.get(
    "https://app.runtm.com/api/cloud/user/openai-key/resolved",
    headers={"Authorization": "Bearer runtm_xxx"},
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/openai-key/resolved",
  { headers: { Authorization: "Bearer runtm_xxx" } },
);
console.log(await response.json());

{
  "has_key": true,
  "source": "user_org",
  "key_preview": "sk-***WxYz"
}

Generic provider keys

For agents other than Anthropic and OpenAI, the API exposes a single set of endpoints parameterised by provider. The supported providers are:

Provider slug	Used by agent
`cursor`	Cursor CLI
`devin`	Devin CLI
`gemini`	Gemini CLI
`copilot`	GitHub Copilot CLI

The personal/org behavior, policy semantics, and enforced requirements match the Anthropic and OpenAI endpoints on the dedicated pages.

Values are never returned. Responses include only a masked preview, a connected / has_key flag, and the active policy (for org keys).

GET /api/user/provider-keys/

Required scope: integrations:read

Read the caller’s stored personal provider key for the current context.

Path Parameters

string

required

One of cursor, devin, gemini, copilot.

Headers

string

required

Bearer <your_api_key>

string

Optional.

Response

string

Echo of the path provider.

boolean

true if the caller has a personal key for this provider.

string

Masked preview, or null.

string

ISO 8601 timestamp of the last update, or null.

curl -X GET "https://app.runtm.com/api/cloud/user/provider-keys/cursor" \
  -H "Authorization: Bearer runtm_xxx"

import requests

response = requests.get(
    "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
    headers={"Authorization": "Bearer runtm_xxx"},
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
  { headers: { Authorization: "Bearer runtm_xxx" } },
);
console.log(await response.json());

{
  "provider": "cursor",
  "connected": true,
  "key_preview": "***WxYz",
  "updated_at": "2026-04-12T18:30:11Z"
}

{
  "provider": "cursor",
  "connected": false,
  "key_preview": null,
  "updated_at": null
}

{
  "detail": "Unsupported provider: 'unknown'. Allowed: ['copilot', 'cursor', 'devin', 'gemini']"
}

PUT /api/user/provider-keys/

Required scope: integrations:write

Save a personal provider key.

Path Parameters

string

required

One of cursor, devin, gemini, copilot.

Request Body

string

required

Provider API key (minimum 8 characters). Treated as opaque text.

Response

Same shape as GET, with connected: true.

curl -X PUT "https://app.runtm.com/api/cloud/user/provider-keys/cursor" \
  -H "Authorization: Bearer runtm_xxx" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "..."}'

import requests

response = requests.put(
    "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
    headers={"Authorization": "Bearer runtm_xxx"},
    json={"api_key": "..."},
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
  {
    method: "PUT",
    headers: {
      Authorization: "Bearer runtm_xxx",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ api_key: "..." }),
  },
);
console.log(await response.json());

{
  "provider": "cursor",
  "connected": true,
  "key_preview": "***WxYz",
  "updated_at": "2026-05-09T22:14:00Z"
}

DELETE /api/user/provider-keys/

Required scope: integrations:write

Remove the caller’s stored personal provider key for the current context.

Path Parameters

string

required

One of cursor, devin, gemini, copilot.

Response

Same shape as GET, with connected: false.

curl -X DELETE "https://app.runtm.com/api/cloud/user/provider-keys/cursor" \
  -H "Authorization: Bearer runtm_xxx"

import requests

response = requests.delete(
    "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
    headers={"Authorization": "Bearer runtm_xxx"},
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/provider-keys/cursor",
  {
    method: "DELETE",
    headers: { Authorization: "Bearer runtm_xxx" },
  },
);
console.log(await response.json());

{
  "provider": "cursor",
  "connected": false,
  "key_preview": null,
  "updated_at": null
}

GET /api/user/provider-keys//resolved

Required scope: integrations:read

Inspect which provider key would be used at session creation time. Same resolution semantics as the Anthropic and OpenAI resolved endpoints above.

Path Parameters

string

required

One of cursor, devin, gemini, copilot.

Response

string

Echo of the path provider.

boolean

true when a key would be available; false when the session would prompt.

string

Where the resolved key came from. One of "org", "user_org", "user", or "none".

string

Masked preview of the resolved key, or null.

curl -X GET "https://app.runtm.com/api/cloud/user/provider-keys/cursor/resolved" \
  -H "Authorization: Bearer runtm_xxx" \
  -H "X-Organization-Id: org_abc123"

import requests

response = requests.get(
    "https://app.runtm.com/api/cloud/user/provider-keys/cursor/resolved",
    headers={
        "Authorization": "Bearer runtm_xxx",
        "X-Organization-Id": "org_abc123",
    },
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/user/provider-keys/cursor/resolved",
  {
    headers: {
      Authorization: "Bearer runtm_xxx",
      "X-Organization-Id": "org_abc123",
    },
  },
);
console.log(await response.json());

{
  "provider": "cursor",
  "has_key": true,
  "source": "user_org",
  "key_preview": "***WxYz"
}

Organization provider keys

Setting and deleting an organization provider key requires the caller to be an org owner or admin.

Organization context is required. Set X-Organization-Id to match the path org_id, or use an org-scoped API key whose org ID matches.

GET /api/organizations//provider-keys/

Required scope: integrations:read

Read the org’s stored provider key (status only) and the active policy.

Path Parameters

string

required

Organization ID. Must match X-Organization-Id (or the API key’s org).

string

required

One of cursor, devin, gemini, copilot.

Response

string

Echo of the path org_id.

string

Echo of the path provider.

boolean

true when the org has a stored key for this provider.

string

Masked preview, or null.

string

"individual" (default) or "enforced".

string

ISO 8601 timestamp of the last update, or null.

PUT /api/organizations//provider-keys/

Required scope: integrations:write

Org owner or admin role required.

Set the org provider key, the active policy, or both. Setting policy="enforced" requires the org to have a stored key (either supplied in the same call or already present).

Path Parameters

string

required

Organization ID.

string

required

One of cursor, devin, gemini, copilot.

Request Body

string

Provider API key (minimum 8 characters when provided). Required when switching to policy="enforced" for the first time.

string

"individual" (default) or "enforced".

Response

Same shape as the GET response, reflecting the updated state.

curl -X PUT "https://app.runtm.com/api/cloud/organizations/org_abc123/provider-keys/cursor" \
  -H "Authorization: Bearer runtm_xxx" \
  -H "X-Organization-Id: org_abc123" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "...", "policy": "enforced"}'

import requests

response = requests.put(
    "https://app.runtm.com/api/cloud/organizations/org_abc123/provider-keys/cursor",
    headers={
        "Authorization": "Bearer runtm_xxx",
        "X-Organization-Id": "org_abc123",
    },
    json={"api_key": "...", "policy": "enforced"},
)
print(response.json())

const response = await fetch(
  "https://app.runtm.com/api/cloud/organizations/org_abc123/provider-keys/cursor",
  {
    method: "PUT",
    headers: {
      Authorization: "Bearer runtm_xxx",
      "X-Organization-Id": "org_abc123",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ api_key: "...", policy: "enforced" }),
  },
);
console.log(await response.json());

{
  "organization_id": "org_abc123",
  "provider": "cursor",
  "has_key": true,
  "key_preview": "***WxYz",
  "policy": "enforced",
  "updated_at": "2026-05-09T22:14:00Z"
}

{
  "detail": "An API key is required when setting policy='enforced'."
}

DELETE /api/organizations//provider-keys/

Required scope: integrations:write

Org owner or admin role required.

Remove the org provider key and reset the policy to "individual".

Path Parameters

string

required

Organization ID.

string

required

One of cursor, devin, gemini, copilot.

Response

Same shape as the GET response, with has_key: false, key_preview: null, and policy: "individual".

​Anthropic resolved key

​GET /api/user/anthropic-key/resolved

​Headers

​Response

​OpenAI resolved key

​GET /api/user/openai-key/resolved

​Headers

​Response

​Generic provider keys

​GET /api/user/provider-keys/

​Path Parameters

​Headers

​Response

​PUT /api/user/provider-keys/

​Path Parameters

​Request Body

​Response

​DELETE /api/user/provider-keys/

​Path Parameters

​Response

​GET /api/user/provider-keys//resolved

​Path Parameters

​Response

​Organization provider keys

​GET /api/organizations//provider-keys/

Path Parameters

Response

​PUT /api/organizations//provider-keys/

Path Parameters

Request Body

Response

​DELETE /api/organizations//provider-keys/

Path Parameters

Response

Anthropic resolved key

GET /api/user/anthropic-key/resolved

Headers

Response

OpenAI resolved key

GET /api/user/openai-key/resolved

Headers

Response

Generic provider keys

GET /api/user/provider-keys/

Path Parameters

Headers

Response

PUT /api/user/provider-keys/

Path Parameters

Request Body

Response

DELETE /api/user/provider-keys/

Path Parameters

Response

GET /api/user/provider-keys//resolved

Path Parameters

Response

Organization provider keys

GET /api/organizations//provider-keys/

PUT /api/organizations//provider-keys/

DELETE /api/organizations//provider-keys/