Runlayer Authentication

generated: '2026-07-21'
method: searched
source: https://docs.runlayer.com/platform-api ; https://docs.runlayer.com/platform-agent-accounts ; https://docs.runlayer.com/oauth-broker ; https://docs.runlayer.com/connecting-clients
docs: https://docs.runlayer.com/platform-api
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header]
  oauth2_flows: [clientCredentials, tokenExchange]
schemes:
- name: RunlayerApiKey
  type: apiKey
  in: header
  parameter_name: x-runlayer-api-key
  key_prefix: rl_
  scopes_by_role:
  - Deploy
  - Shadow AI Scan
  - Security Scan
  notes: >-
    Personal API keys authenticate as the creating user; Organization API keys
    authenticate as the workspace and are role-scoped. Send as the
    x-runlayer-api-key header (NOT a bearer token).
- name: AgentAccountM2M
  type: oauth2
  flow: clientCredentials
  token_url: /api/v1/oauth/token
  grant: client_credentials
  notes: >-
    Agent Accounts (beta) authenticate with a Client ID + Client Secret to mint
    a machine-to-machine agent JWT (1h TTL), acting as the agent itself.
- name: AgentAccountOBO
  type: oauth2
  flow: tokenExchange
  token_url: /api/v1/oauth/token
  grant: urn:ietf:params:oauth:grant-type:token-exchange
  standard: RFC 8693
  notes: >-
    On-Behalf-Of: exchange the agent JWT (actor_token) for an OBO token bound to
    a subject user; enforces the intersection of agent + user policies.
- name: OAuthBroker
  type: openIdConnect
  host: https://oauth.runlayer.com
  standards: [OAuth 2.0, OIDC, PKCE, DCR]
  notes: >-
    Centralized OAuth/OIDC broker for upstream vendor connectors (GitHub, Asana,
    Ramp, Datadog, …). PKCE on the MCP<->Broker hop and Broker<->Vendor hop when
    supported; Dynamic Client Registration.
error_semantics:
  '401': Missing or invalid API key / unauthenticated request.
  '403': Key role lacks access to the endpoint.