How can my coding agent create an API key in Rius?

Rius lets your coding agent create an API key with the create_api_key tool on the Rius MCP server, from a signed-in session where you are an admin. Say “Create an API key so this agent can send traces” and the agent calls the tool. The reply contains the new key in plain text, shown exactly once. A connection that itself authenticates with an API key cannot use this tool.

How it works

The Rius MCP server exposes create_api_key as one of its tools. You ask in plain words and your client picks the tool and its arguments. The full list is in the tool reference.

The tool takes three arguments, all optional:

• name: a label for the key, shown later in the workspace’s key list. It defaults to glassflow-connect-agent.
• scopes: what the key can do. The default is ["ingest"], a key that sends telemetry. Use ["ingest", "read"] for a key that sends and queries, or ["read"] for a key that only queries. A read key can be the bearer token for a headless MCP connection.
• workspace: a workspace name or ID, or org-name/workspace-name when the same name exists in two of your organizations. It defaults to your default workspace. Ask the agent to run list_workspaces to see your options.

Three rules apply:

• You need admin access in the target workspace.
• The connection must be interactive, signed in with your Rius account over OAuth. If the connection uses an API key, create_api_key is refused, so a leaked agent key cannot mint more keys.
• The alert-management scopes, alerts:manage and channels:manage, cannot be minted through this tool. An admin issues them in the console, in the Connect an agent dialog on the MCP page.

Set it up

1. Connect your client to the Rius MCP server with an OAuth sign-in. For Claude Code, run this in your terminal. The sign-in opens the first time a session uses the server. If you already use the Rius plugin, it registers this server as rius, so skip this step. Other clients are covered on the MCP page.

   claude mcp add --transport http rius https://mcp.eu.console.rius-glassflow.com/mcp

2. Check that you are signed in and see which workspaces you can reach. Ask:

   Who am I in Rius, and which workspaces can I access?

   The agent calls get_me and answers with your email, your role in each organization and a workspace table. Your role must be admin in the organization that owns the workspace.

3. Ask for the key in plain words. For a key that sends traces:

   Create an API key so this agent can send traces.

   The client sends this call:

   { "name": "create_api_key", "arguments": { "name": "my-agent" } }

4. For a key that can also read traces over MCP, ask:

   Give it a key that can also read traces over MCP.

   { "name": "create_api_key", "arguments": { "scopes": ["ingest", "read"] } }

5. Copy the key from the reply right away and store it as a secret, for example in a RIUS_API_KEY environment variable or a CI secret. Keep it out of committed config files.

What you get

• A new API key in the workspace you chose, with the label you gave it. You can find it in the workspace’s key list.
• The plaintext key in the response. It is shown exactly once and cannot be retrieved afterwards, so save it before you move on.
• A key whose capabilities match the scopes you asked for. An ingest key sends telemetry from the SDK. A read key authenticates a headless MCP connection, so agents in CI jobs or cron schedules can query your traces without a browser.
• A clear refusal instead of a change when the connection is not allowed to mint keys, with a message that explains why.

For what a key-authenticated connection can reach once you have a read key, see the MCP page. To watch what your agents do in production after they send traces, see Monitor AI agents in production.

When something else fits

• Use the console when you need a key with alert-management scopes. Manage alert rules and Manage notification channels are minted only in the Connect an agent dialog, by an admin. You can also create ingest or read keys in Settings → API keys.
• Use the Connect an agent button on the console’s MCP page when you want a read-scoped key and the matching client config in one step.
• If your agent already runs with an API key, mint new keys from an interactive session or the console instead.

Related