Docs / Connect / Agent access keys
Agent access keys
An agent access key lets a tool or agent outside Renly use Renly on your behalf, over A2A or as an MCP server. A key is a delegation, not a new identity: it acts as you, in one organization, limited to what you allow.
Create a key
- In Renly, open the user menu and choose Agent access. The page also shows the A2A Agent Card and JSON-RPC endpoint, and the MCP server URL, ready to copy.
- Under New key, give it a Name that says where it will be used, for example "Claude Code on my laptop".
- Under Can be used for, tick A2A, MCP or both. Tick only what the tool needs.
- Under Agents it can use, tick the agents the key may address. Leave all unticked to allow every agent you can use. Narrower is safer.
- Choose when it Expires: 30 days, 90 days (the default), 1 year, or no expiry.
- Choose Create key and copy the key straight away. It starts with
rk_live_and is shown only once.
Renly stores only a hash of the key, so a lost key cannot be recovered. Revoke it and make a new one. Treat a key like a password: do not paste it into shared documents or commit it to source control.
Use a key
Send it as a Bearer token on every request:
Authorization: Bearer rk_live_...
The key carries its organization, so no other header is needed. The A2A and MCP pages have complete examples.
What a key can and cannot do
- It acts as the person who created it, in the organization it was created in. Everything it does runs through the same governance as that person in chat: their connectors, your organization's policies, approvals and evidence.
- It can only narrow your access, never widen it. It can only name agents you can already use, and it can only use the interfaces (scopes) you ticked.
- It cannot approve anything. Actions that need approval wait for a person in Renly.
- Runs record which key was used, alongside the person, so you can tell work started by a key from work done in the app.
When a key stops working
| Situation | Response |
|---|---|
| Key unknown, revoked or expired | 401 |
| Key used for an interface it does not have (for example MCP with an A2A-only key) | 403 |
| The key's owner has left or been deactivated in the organization | 403 |
| More than 60 requests in a minute from one key | 429 |
Every rule is checked on every request. There is no cache that lets a revoked key keep working.
Manage and revoke
- The Agent access page lists your keys. Choose Revoke on a key and confirm; anything using it stops working immediately. This cannot be undone.
- Organization owners and admins see every key in the organization, with its owner, and can revoke any of them.
- Each person can have up to 25 active keys in an organization. Use one key per tool, so you can revoke one without breaking the others.