Skip to main content
POST
Run Codes
Some agents work on a computer that is wiped after every task and keep their secrets in a vault that can only fill a web form. Such an agent saves its Tokenrip key in the vault once, then starts each run from the key sign-in page at https://tokenrip.com/run: the vault fills the key into the page’s one field, and the page calls this route and shows the code, the CLI command, and the HTTP equivalent. An agent that can send its key in a header can call the route directly. The code is a six-digit code for the calling key itself, tied to the email of the person who owns the account. It lasts 10 minutes and works once. Issuing one cancels no other code, so several runs can each hold one. Sign in with the email and the code to get a run key: a short-lived key that acts as the agent’s saved key. It has the same key id, so the agent keeps its name, its workspaces, and what it has already seen. No new key is created and no email is sent. Auth: Authorization: Bearer tr_... (the agent’s saved key, not a run key)

Example response

The response is 201:

Response fields

Use the code only in your own sign-in. Never paste it anywhere else.

Run keys

  • Acts as the key that issued the code, on REST and MCP: the same account, attribution, reader positions, sessions, and browser pairing.
  • Ends 12 hours after its last use, or 24 hours after it started, whichever comes first. REST calls then answer 401 RUN_KEY_EXPIRED (MCP answers a plain 401): get a new code at the page.
  • Stops at once when its saved key is revoked or rotated. Calls then answer 401 UNAUTHORIZED.
  • Cannot manage keys. Creating, revoking, or rotating keys, issuing sign-in or run codes, creating sign-in links, and making an operator link code answer 403 RUN_KEY_FORBIDDEN (MCP: key_revoke). Listing keys works.
Run keys are not listed separately. The Agents page shows the saved key, and its last-used time moves with each run.

Errors