API Keys

Daytona API keys authenticate requests from the SDKs, the CLI, and the API to the resources in a project. To pass a key, see authentication.

Organization API keys cover organization-level operations that are not tied to a project.

Every project API key belongs to exactly one project and carries an explicit list of permissions; its requests are confined to both. Keys can carry an expiry. Revocation applies to new requests; a regional proxy can accept a revoked key for up to 30 seconds.

Create an API key

Create an API key to authenticate Daytona SDK and API requests.

1. Go to Daytona Dashboard ↗
2. Select the project in the header switcher
3. Click Create API Key
4. Enter a Key Name, optionally set an expiry, and select permissions
5. Click Create API Key
6. Copy the API key to your clipboard and use it to authenticate requests

daytona key mint --project PROJECT_ID \
  --name my-api-key \
  --permission write:sandboxes,delete:sandboxes \
  --expires 2027-01-01T00:00:00Z

Credentials

Daytona accepts two bearer credentials, named differently in this page's API examples:

Organization API keys (dtno_...) are a third kind, scoped to an organization rather than a project; that section lists the scopes they can hold.

Permissions & Scopes

Operations

List API keys

List the API keys of a project. The list never contains tokens. Revoked keys are hidden unless requested; Daytona deletes revoked and expired keys 7 days after they stop working.

daytona key list --project PROJECT_ID --include-revoked

Get by ID

curl 'https://api.daytona.com/api-keys/KEY_ID' \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN'

Get the current API key

Get the API key that authenticates the request, including the project and organization it acts in and the permissions it carries. The response never contains the token.

from daytona import Daytona

daytona = Daytona()
key = daytona.v2.current_api_key()
print(key.name, key.project_name, key.org_name)
print(key.project_permissions)

Exchange a token

Exchange a signed-in user's session token for a short-lived access token scoped to one project. The access token carries the user's own permissions in that project and authenticates workload requests in place of a project API key. Organization API keys cannot be exchanged.

curl 'https://api.daytona.com/auth/token' \
  --request POST \
  --header 'Authorization: Bearer YOUR_OIDC_TOKEN' \
  --header 'Content-Type: application/json' \
  --data '{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token": "YOUR_OIDC_TOKEN",
  "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "project_id": "PROJECT_ID"
}'

{
  "access_token": "eyJ...",
  "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "token_type": "Bearer",
  "expires_in": 300
}

Revoke an API key

Revoke an API key. Revocation cannot be undone. New requests made with the key fail, except at a regional proxy, which can accept the key for up to 30 seconds after revocation. Daytona deletes the revoked key 7 days later.

1. Go to Daytona Dashboard ↗
2. Click Revoke next to the API key you want to revoke
3. Confirm the revocation

daytona key revoke KEY_ID

Service accounts

Service accounts are non-human identities in your organization. Use them to own API keys for automation so that the keys are not tied to a person's membership.

Create a service account

daytona service-account create my-service-account --role developer --org ORG_ID

Create a service account key

Create an API key owned by a service account. The key keeps working when its creator leaves the organization. Outside the default project, the service account must first be added to the project, and the key can carry only permissions you and the service account both hold.

1. Go to Daytona Dashboard ↗
2. Click Create API Key
3. Under Owner, select the service account
4. Enter a Key Name, select permissions, and click Create API Key

daytona key mint --project PROJECT_ID \
  --name my-service-account-key \
  --permission write:sandboxes \
  --service-account SERVICE_ACCOUNT_ID \
  --org ORG_ID

List service accounts

daytona service-account list --org ORG_ID

# Include archived service accounts
daytona service-account list --org ORG_ID --include-archived

Get a service account

daytona service-account get SERVICE_ACCOUNT_ID

Update a service account

Update a service account's name, description, or roles. Fields you leave out stay unchanged, and new roles replace the whole role set. When the new roles are narrower, Daytona revokes the account's project API keys that exceed them.

# The CLI updates the name (--name) and roles (--role); it cannot set the description
daytona service-account update SERVICE_ACCOUNT_ID --role maintainer

Archive a service account

Archive a service account. This revokes every project API key it owns. An archived account cannot be updated, added to projects, or given new keys, and lists hide it by default.

daytona service-account delete SERVICE_ACCOUNT_ID

Organization API keys

Organization API keys authenticate organization-level operations that are not tied to a project.

# Create
daytona org-key mint --org ORG_ID --name my-org-key --permission read:audit

# List
daytona org-key list --org ORG_ID --include-revoked

# Revoke
daytona org-key revoke KEY_ID