Web keys

A web key lets a web page run tasks without a secret. See Add AI to a web page.

Reading web keys needs View usage and limits. Creating, changing, and revoking them is for people with Developer access or more, from the console; API keys cannot.

List web keys

The answer is every web key in the project, revoked ones too, oldest first.

Read a web key

{
  "id": "dpk_01m3d44nq41sec9tj8m2tbgh18",
  "name": "Shop",
  "origins": ["https://shop.example"],
  "localhost": false,
  "tasks": ["support-reply"],
  "unitsPerDay": 10000,
  "unitsPerMonth": 200000,
  "visitor": { "requestsPerMinute": 10, "unitsPerDay": 1000 },
  "sessionsPerHour": 60,
  "createdBy": "01m3c081d2wj4g63qcr53pa1yh",
  "createdAt": "2026-09-30T08:00:00Z",
  "updatedBy": "01m3c081d2wj4g63qcr53pa1yh",
  "updatedAt": "2026-09-30T08:00:00Z",
  "revokedAt": null
}

Create a web key

namestringRequired

1 to 100 characters, for your team.

originsarrayRequired

Up to 20 addresses the key works from, such as https://shop.example: https, a host, and a port if it is not 443, with no path. Each subdomain is its own address. Can be empty when localhost is on.

localhostboolean

true also allows http://localhost, http://127.0.0.1, and http://[::1] on any port, for development.

tasksarray

The names of the tasks the key may run, up to 100. Empty by default, so a new key runs nothing until you choose.

unitsPerDayintegerRequired

The AI units the key may use in a day, UTC, from 1. At or under unitsPerMonth.

unitsPerMonthintegerRequired

The AI units the key may use in a month, from 1.

visitor.requestsPerMinuteintegerRequired

Runs one visitor may start in a minute, 1 to 600.

visitor.unitsPerDayintegerRequired

AI units one visitor may use in a day, UTC, at or under unitsPerDay.

sessionsPerHourintegerRequired

New visits one network may start in an hour, 1 to 10,000.

The answer is 201 with the key. A project holds up to 20 web keys that are not revoked.

Change a web key

Send every field, as for creating one. Pages see the change within 30 seconds. A revoked key cannot change.

Revoke a web key

The answer is the key, with revokedAt set. Pages using it are refused with key_not_found within 30 seconds. It cannot be restored.

Routes for web pages

The SDK’s web client calls these for you. They answer any page, with Access-Control-Allow-Origin: * and no cookies, and check the page’s Origin header against the key.

Ask for a challenge

Send { "key": "dpk_…" }. The answer has challenge, difficulty, and expiresAt, 2 minutes away. Find a whole number, written in decimal, such that the SHA-256 of the challenge, a colon, and the number starts with at least difficulty zero bits.

Start a visit

Send key, challenge, solution, and optionally visitor, the visitor ID from an earlier visit. The answer has token, visitor, and expiresAt, an hour away. Each challenge works once.

Run a task

With Authorization: Bearer and the visit’s token. The body and the answer are the same as running a task from a server. Runs count toward the key, the visitor, and the project, and the first cap reached refuses the run.