Authentication

Create an API key

Create a key on the API Keys page in the dashboard sidebar. Keys are prefixed rbk_, shown once at creation, stored hashed, and revocable at any time. A key acts as the user who created it, scoped to one organization, with exactly that user's permissions — there is no separate permission model to learn.

Organization owners and admins manage keys. The secret is displayed once — store it in your secret manager, not your repository.

Authenticate

The same key, presented three ways:

spaceboy login --token rbk_your_key_here
spaceboy whoami
# Or browser-based device login (no key pasting):
spaceboy login

Environment variables

For CI and agents, skip stored config entirely — the CLI and SDK both read the environment:

• REPOBOT_API_KEY — the rbk_ key; overrides any stored login.
• SPACEBOY_ACCOUNT — the organization (account id) to act in.
• REPOBOT_API_URL — override the endpoint (rarely needed).

export SPACEBOY_API_KEY=rbk_...
spaceboy projects list   # no login step needed

Target an organization

Keys are scoped to the organization they were created in, and act there by default. To act in another organization you belong to, name it explicitly:

spaceboy orgs list            # organizations you belong to
spaceboy orgs use acct_...    # set the default org

From Python (no SDK needed)

GraphQL makes raw API calls trivial from any language — one endpoint, one header, one POST shape. From Python:

import os, httpx
def repobot(query: str, variables: dict | None = None) -> dict:
    response = httpx.post(
        "https://api.repobot.dev/graphql",
        headers={"Authorization": f"Bearer {os.environ['REPOBOT_API_KEY']}"},
        json={"query": query, "variables": variables},
    )
    body = response.json()
    if body.get("errors"):
        raise RuntimeError(body["errors"][0]["message"])
    return body["data"]
projects = repobot("{ projects(input: {}) { nodes { id name } } }")

Every API-lane example in this reference works verbatim through a helper like this.

Plans and permissions

A key can see and do exactly what its creator can, enforced by the same role and plan checks as the dashboard. Plan-gated operations fail the same way in every lane — the CLI exits with code 4, and the API returns a structured error naming the plan you need.

Enterprise-gated operations — audit log export, SSO configuration, governance policies — require the Enterprise plan through the API too, exactly as in the dashboard.