API tokens · Rockslab docs

A token lets a script, a CI job or an agent use the Rockslab API as you — never with more rights than you have.

Create a token

Cabinet → Credentials → + Credential → Rockslab API. Give it a name and an expiry, and copy it once — we keep only a hash.

ci deploy

Acts as you, with your role

New

brk_•••••••••••••••••••••••• Copy

Copy it now — this is the only time it is shown.

Credentials › Rockslab API — the token is shown once

Name — what it is for: ci deploy, claude on my laptop.
Expires in — 90 days by default, at most 365; 0 means never. Shorter is kinder to future you.

The token acts as you: your role, your scope, in this one organization. There is no role to pick — a token can never do more than its person. It looks like brk_… and goes in an Authorization: Bearer header.

What a token cannot do

Some things stay with a person in the cabinet, on purpose: inviting or removing people, billing and the plan, deleting the organization, minting or listing tokens, and taking an admin kubeconfig. A refusal there is the product working, not a bug to route around.

Limits

Every call costs agent tokens from two hourly budgets — the organization’s and yours. Both grow with the size of your infrastructure; see Limits. Jobs started with a token count toward running jobs like any other. The cabinet sidebar shows the budgets and when they refill.

Calling the API

Every call is a POST of JSON to https://cloud-api.rockslab.io/bedrock.v1.CabinetService/<Method>, with the token as a bearer. Most methods take your organization's id as orgId.

curl -X POST https://cloud-api.rockslab.io/bedrock.v1.CabinetService/ListMyClusters \
  -H "Authorization: Bearer $ROCKSLAB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"orgId":"o-jpqv6bfnj0"}'

Response 200

{
  "mappings": [
    { "id": "cl-etqp9ndp4x", "name": "test1", "accountPublicId": "a-kvpr5k0ct9", "cloud": "hcloud", "…": "…" }
  ]
}

Not sure of your organization's id? GetMe (an empty {} body) lists your memberships. More methods: Endpoints.

Revoking

Credentials → the token's ⋯ → Revoke…. It stops at once. Lost a token, or pasted it into a chat by accident? Revoke and mint a new one; it takes a minute and settles the matter.