API keys and login

Two ways to prove who you are, for two jobs.

Situation	Use
Browser, in-app assistant, hosted MCP	Your CloudSprite login (the same account as the website)
Laptop scripts, CI, headless jobs	An API key

Create and store a key

Org or team admins issue keys in account settings (cloudsprite.io/settings/api-keys). Copy the secret once; CloudSprite will not show it again.

On a laptop:

cloudsprite init
# or:
export CLOUDSPRITE_API_KEY=...

The SDK resolves credentials in this order: explicit Client(api_key=...) → the CLOUDSPRITE_API_KEY environment variable → ~/.cloudsprite/config (written by cloudsprite init with owner-only file permissions).

Do not commit keys. Do not paste them into notebooks you will share, into chat, or into an assistant prompt. Rotate a key if it leaked.

Multi-org keys also need a default organization:

import cloudsprite as cs

cs.connect()
cs.set_org("acme")
cs.set_team("rf-lab")

Libraries and tests should prefer Client(api_key=..., org="acme", team="rf-lab") so two sessions cannot clobber each other’s team.

What a key can do

A key acts as the user (or service identity) it was minted for. It cannot see another team’s projects. A viewer-scoped identity still cannot upload or publish.

Interactive assistant access does not need you to paste a key. If a tool asks for a token in chat, that is the wrong path.