Authentication

The Computer Agents API uses API keys to authenticate requests. All API requests must include your API key.

Getting an API Key

Sign up at computer-agents.com
Navigate to Settings → API Keys
Click Create API Key
Copy and securely store your key

API keys grant full access to your account. Never share them or commit them to version control.

Using Your API Key

Include your API key in the Authorization header:

cURL


curl https://api.computer-agents.com/v1/threads \
  -H "Authorization: Bearer tb_xxxxxxxxxxxx"

JavaScript


const response = await fetch('https://api.computer-agents.com/v1/threads', {
  headers: {
    'Authorization': `Bearer ${process.env.COMPUTER_AGENTS_API_KEY}`
  }
});

Python


import requests
 
response = requests.get(
    'https://api.computer-agents.com/v1/threads',
    headers={'Authorization': f'Bearer {API_KEY}'}
)

Authentication Methods

Method	Header	Example
Bearer Token	`Authorization`	`Authorization: Bearer tb_xxxxxxxxxxxx`
X-API-Key	`X-API-Key`	`X-API-Key: tb_xxxxxxxxxxxx`

Bearer token is recommended. Both methods provide identical access.

API Key Types

Type	Prefix	Description
Standard	`tb_`	Regular user keys with billing
Internal	`tb_internal_`	Service keys (unlimited rate)

Permissions (Scopes)

API keys have scoped permissions:

Permission	Description
`*`	Full access to all resources
`threads:read`	Read threads and messages
`threads:write`	Create, update, delete threads
`agents:read`	Read agent configurations
`agents:write`	Create, update, delete agents
`environments:read`	Read environments
`environments:write`	Create, update, delete environments
`schedules:read`	Read schedules
`schedules:write`	Create, update, delete schedules
`billing:read`	Read billing and cost data
`execute`	Execute tasks in threads

Public Endpoints

These endpoints don’t require authentication:

GET /health - Health check
GET /metrics - System metrics
GET /metrics/history - Execution history

Environment Variables

Store your API key in environment variables:


# .env.local
COMPUTER_AGENTS_API_KEY=tb_xxxxxxxxxxxx

Never commit .env files to version control. Add them to .gitignore.

Authentication Errors

Status	Error	Description
401	`Unauthorized`	Missing or invalid API key
403	`Forbidden`	API key lacks required permissions
402	`Payment Required`	Insufficient budget balance

Error Response


{
  "error": "Unauthorized",
  "message": "API key required. Provide via Authorization header (Bearer token) or X-API-Key header."
}

Security Best Practices

Rotate keys regularly - Create new keys and revoke old ones periodically
Use environment variables - Never hardcode keys in source code
Set budget limits - Prevent unexpected costs with spending limits
Monitor usage - Review API usage in your dashboard
Separate environments - Use different keys for dev/staging/production
Limit scopes - Only grant permissions the key needs