API keys
Create keys, cap what they can spend, and rotate, pause, or revoke them.
An API key is a deva_ bearer secret an agent authenticates with. Keep keys
server-side — never ship one to browser code.
Create a key
On the Keys page choose New Key and name it, then copy the full deva_ value — it's
revealed once and never shown again. You can hold up to 10 active keys; each row shows
its name, status, key prefix, created date, and last-used. Store it in an environment variable
or a secrets manager:
export DEVA_API_KEY="deva_..."Spend caps
Give a key a per-period cap (daily / weekly / monthly, resetting at the start of each UTC period) and/or an optional lifetime cap, from the key's controls. A cap hit stops spending but never revokes the key — a per-period cap resumes next period; a lifetime cap holds until you raise it. Set a cap before handing a key to an agent.
Pause, rotate & revoke
- Pause — reversibly stop a key's spending; switch it back on anytime.
- Rotate — issue a new secret; the old value stops working immediately.
- Revoke — permanently kill a key (from the ⋯ menu); any request using it fails at once.