Get an API key

Create an account​

1

Sign up

Open /dashboard/sign-up. Enter your email, password, and organization name.

Your password must contain at least 10 characters.

2

Sign in

Use /dashboard/sign-in when you return. Pantheon opens the keys page after sign in.

3

Create a key

Enter a name on the keys page. Pantheon uses the full tenant builder scopes by default.

4

Copy the secret

Copy the secret immediately. Pantheon shows it once and stores only its hash.

Use the key​

Set the production base URL and the one-time secret.

export PANTHEON_BASE_URL="https://pantheon-todo.alethiconsulting.com/pantheon-api"
export PANTHEON_API_KEY="PANTHEON_API_KEY"

Send the key as a bearer token. API keys cannot list, create, or revoke other keys, and cannot create or edit workspace users. Those are account operations and need a signed-in session.

Scopes are enforced on every route. A key that lacks the scope an operation names is refused with HTTP 403 and permission_denied, and the message names the missing scope. Every operation in api/openapi/openapi.yaml states the scopes it requires under its security entry. A write scope does not imply the matching read scope: ask for both, or use a family wildcard such as agents:*.

Manage keys​

The keys page lists each key without its secret.

Revoke a key from the same page. Create a replacement before revoking an active key.

Auth release routes​

Signup response​

Send email, password, and organization_name. A successful request returns HTTP 201.

{
  "user": {"id": "user_123", "email": "you@example.com"},
  "tenant": {"id": "tenant_123", "name": "Acme", "slug": "acme"},
  "session": {"token": "ps_SESSION_TOKEN", "expires_at": "2026-10-04T12:00:00Z"}
}

Key response​

Send name and optional scopes. A successful request returns HTTP 201.

{
  "id": "key_123",
  "name": "Development",
  "prefix": "pk_example",
  "scopes": ["..."],
  "created_at": "2026-09-04T12:00:00Z",
  "secret": "PANTHEON_API_KEY"
}

Limits and sessions​

The dashboard stores the session token in localStorage under pantheon.session.

Manage your application​

Create and edit agents, publish deployments, and review deployment history on the dashboard Agents page.

Register tools, create versions, and deprecate versions on the dashboard Tools page.

Filter sessions, inspect usage and events, and archive sessions on the dashboard Sessions page.

Reset a password​

Change a known password from the account page.

Email delivery is not available yet. An admin resets a forgotten password with POST /v1/admin/users/{id}/password.

Pitfalls​