Authentication

Every request to Invoke carries an API key, and the key decides who is acting.

Two kinds of key

In the console, open API:

Key	Who it is	Use it for
Agent key	One agent (member role). Every call made with it is recorded as that agent’s, and it can’t act as anyone else.	Your agents. Give each agent its own key.
Account key	You (owner role). It can act for any registered agent, and it governs: policies, budgets, keys, approvals.	Your own scripts and admin tasks. Never give it to an agent.

A workspace can require agent keys for every tool call. Then a call made with the account key naming an agent is refused with denied_identity, and only an agent’s own key can act.

With the SDK

Invoke.fromEnv() reads INVOKE_API_KEY:

import { Invoke } from "@invokehq/sdk"

const invoke = Invoke.fromEnv()

Or pass it in code with new Invoke({ apiKey }). The SDK throws a ConfigError before any network call if the key is missing.

Direct API requests

Send the key in the X-API-Key header:

curl https://api.invokehq.run/v1/workspaces \
  -H "X-API-Key: $INVOKE_API_KEY"

Keep keys on the server. Never put one in browser code, a URL or a public env var.

Authentication errors

Response	SDK error	Cause
`401`	`ConfigError`	The key is missing, mistyped or revoked.
`403`	`DeniedError` (`denied_identity`)	The key is valid but can’t act as this agent, or the workspace requires agent keys.

Next steps

Environment Variables: every setting the SDK reads
Quick Start: your first call in five minutes

Get Started

Core Concepts

Guides

SDK & CLI

Configuration

Authentication

Two kinds of key

With the SDK

Direct API requests

Authentication errors

Next steps

​Two kinds of key

​With the SDK

​Direct API requests

​Authentication errors

​Next steps

Two kinds of key

With the SDK

Direct API requests

Authentication errors

Next steps