Authentication

One credential: your Veyto API key.

const veyto = new VeytoClient({
  baseUrl: "https://sandbox.veyto.io",
  apiKey: process.env.VEYTO_API_KEY!,
  // …
});

It travels as Authorization: Bearer <key>. Keep it server-side — it can change spending limits and unfreeze agents. Never ship it in a browser bundle.

Scopes

A sandbox key carries what a developer needs and nothing more: manage your own agents and policies, make payments, read your own history. It cannot create accounts, cannot freeze accounts, and cannot see anything belonging to another developer.

If your key leaks

Tell us. We issue a replacement, you switch, and we revoke the old one — both work during the overlap, so there is no outage in the middle. Your account, agents, policies and receipts are untouched by a rotation.

Revocation is immediate on the next request, and permanent: a revoked key is never reactivated.

Rate limits

120 requests per minute per key. Over that returns 429 with:

retry-after: 37
ratelimit-limit: 120
ratelimit-remaining: 0
ratelimit-reset: 1789782793

The limit is set so ordinary development never notices it; it exists so one runaway loop cannot degrade the sandbox for everybody else.

Request ids

Every response carries x-request-id. Quote it in a bug report and we can find the exact request. You may also send your own.