auth.md and configure it for autonomous operation. Whether you’re building a custom agent, using an orchestration framework, or configuring an AI coding tool, the setup is the same.
Quick start
- Create an API key in the dashboard, or create
another with
POST /api/account/keysusing an existing key - Point your agent at
https://developer.encrata.com/auth.md - Provide the API key to your agent’s configuration, for example as
ENCRATA_API_KEY
GET /api/account/credits call, and follows the docs index to find endpoints.
Provide the API key directly
If you already have an API key, just configure your agent with it:Give the agent the API contract
Point your agent atauth.md and provide the API key through its secret or
environment configuration. Never give the agent your Encrata password.
System prompt example
Framework integration
LangChain
CrewAI
Custom agent
Key management best practices
Create named keys per agent
Create named keys per agent
Give each agent its own named key so you can revoke individually without disrupting other agents:
Rotate keys periodically
Rotate keys periodically
Encrata keys don’t expire. A key works until you disable or revoke it, so rotating periodically limits blast radius if one is compromised.
Set a credit cap per key
Set a credit cap per key
All keys share the account’s credits. Set an optional credit cap on each key so one agent can’t drain the balance. Once a key reaches its cap, its requests return
402.Never commit keys to source control
Never commit keys to source control
Use environment variables or secret managers:
Monitor credit usage
Monitor credit usage
Set up alerts when credits drop below a threshold. Your agent should check
GET /api/account/credits before batch operations.Rate limits
Requests are limited to 200 per minute per account, shared by every key. Every response includesX-Ratelimit-Limit, X-Ratelimit-Remaining, and
X-Ratelimit-Reset. On a 429, wait X-Ratelimit-Reset seconds, then retry,
up to 3 attempts. 429 responses don’t include a Retry-After header.
See Rate limits for the current limit, headers, and retry guidance.
Monitoring agent activity
All API calls made with your key are logged in your dashboard. You can:- See which endpoints your agent called
- Track credit consumption over time
- Identify unusual patterns
- Revoke a key instantly if needed