Runtime Authentication

generated: '2026-07-21'
method: searched
source: https://docs.runtm.com/cloud-api/authentication
docs: https://docs.runtm.com/cloud-api/authentication
notes: >-
  The Runtime Cloud API authenticates with scoped bearer-token API keys. No published OpenAPI spec
  (the served /api-reference/openapi.json is a Mintlify sample placeholder), so this profile is
  captured from the documented auth page rather than derived from securitySchemes.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
schemes:
- name: BearerApiKey
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: "runtm_sk_ (opaque secret, shown once at creation)"
  description: >-
    Every request must include `Authorization: Bearer runtm_sk_...`. Keys are scoped to a user and
    optionally to an organization. Keys carry a set of `resource:action` scopes (see
    scopes/runtime-scopes.yml). The raw secret is displayed only once at creation.
  sources: [docs.runtm.com/cloud-api/authentication]
org_context:
  header: X-Organization-Id
  description: >-
    Optional header to scope a request to an organization's shared resources (e.g. org_abc123).
    Embedded in org-created keys; omitted on a personal key returns personal resources.
key_management:
  creation: "Dashboard > Settings > API Keys"
  presets: [Session automation, Full access, Read-only]
  verify_endpoint: https://app.runtm.com/api/cloud/auth/verify
  rotation: "delete + recreate keys; role downgrades reduce a key's effective permissions at request time"