---
title: Platform Management quickstart
url: https://runapi.ai/docs/guides/platform-management/quickstart.md
canonical: https://runapi.ai/docs/guides/platform-management/quickstart
locale: en
---

# Platform Management quickstart

Platform Management lets account administrators create, inspect, update,
and revoke standard API keys and guardrails without using the dashboard
for every change.

## Create a management key

Create a management key from the [Management Keys
page](/management_keys), then store it separately from standard
application keys. Send it as a bearer token only to Platform Management
endpoints.

```http
Authorization: Bearer YOUR_MANAGEMENT_KEY
```

A standard API key cannot call key or guardrail management endpoints. A
valid management key can still receive `403 Forbidden` when its owner no
longer has the required account role.

## List standard API keys

Use `GET /api/v1/keys` to inspect keys visible to the management key's
account:

```shell
curl "https://runapi.ai/api/v1/keys" \
  -H "Authorization: Bearer YOUR_MANAGEMENT_KEY"
```

Use returned public identifiers for later retrieve, update, revoke, or
guardrail-assignment requests. Never infer access from a key name or
masked token.

## Create and rotate a key

Create an application key with `POST /api/v1/keys`. The full secret is
returned only in the create response, so persist it in your secret
manager before discarding that response. Rotation should create a
replacement, deploy it to the application, verify traffic, and then
revoke the old key.

```shell
curl -X POST "https://runapi.ai/api/v1/keys" \
  -H "Authorization: Bearer YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production worker"}'
```

## Apply guardrails

Guardrails are reusable account policies for model, provider, and
spending controls. Manage policies through `/api/v1/guardrails`, then
use `/api/v1/guardrail_assignments` to attach or remove them. Treat a
rejected assignment as a policy or ownership failure instead of silently
continuing without the guardrail.

## Handle management errors

* `401 Unauthorized` means the credential is missing, malformed,
  revoked, or invalid.
* `403 Forbidden` means the credential class or account role cannot
  perform the operation.
* `404 Not Found` means the requested resource is not visible to the
  authenticated account.
* `422 Unprocessable Content` means one or more submitted values violate
  a resource rule.