> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexinference.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent keys

> Create a key that holds the deadline, for tools that can't set one per request.

Most tools build their own request body. They give you nowhere to put `start_within`, and every request without it returns [`400 missing_start_within`](/errors#missing_start_within).

An agent key solves that. It holds the deadline itself, so every request the tool makes routes by it.

## Create the key

1. Open the [dashboard](https://www.flexinference.com/dashboard) and go to **API**, then **FlexInference keys**.
2. Press **Create agent key**. The plain **Create key** button makes a key with no deadline.
3. Name the key. The name is optional and only helps you find it later.
4. Pick the deadline. **Flex race** comes preselected, and it's the reason agent keys exist.
5. Set the duration if you took **Flex race**. Type any length from 5 seconds to 10 minutes, or take a quick pick.
6. Press create, then copy the secret. The dashboard shows it once.

Find the key again with the **Agent keys only** filter on the keys list. A policy chip on the row shows what it holds.

## What each deadline does

| Option        | Wire value | What happens                                                              |
| ------------- | ---------- | ------------------------------------------------------------------------- |
| **Flex race** | a duration | Tries the cheaper tier for that long, then falls back to standard.        |
| **Standard**  | `default`  | Serves the normal tier. Works with every model and every route.           |
| **Priority**  | `priority` | Starts sooner and costs more. Worth it when a person waits on the answer. |
| **Auto**      | `auto`     | Lets the provider pick. Not available on Gemini models.                   |

**Flex race** costs less and starts later. You feel that delay in an interactive loop, so a tier suits a tool you sit and watch.

<Note>
  **Priority** and **Auto** need a BYOK organization. [Managed
  Keys](/billing#managed-keys) doesn't offer either tier, so an organization
  with any managed provider is refused at creation with `400
      invalid_key_defaults`. The refusal covers a duration's fallback tier too.
  Choose **Standard** or **Flex race** there.
</Note>

## What the key carries

A key stores up to three fields.

* `start_within`: a duration or a tier name. Always set.
* `on_no_flex`: the tier a duration falls back to. The dashboard always stores `default` and never asks. Only the API lets you choose `priority`.
* `retry`: a `count` from 1 to 5, with optional `backoff` and `jitter`. Unset unless you ask for it.

Leave `retry` alone unless you have a reason. Most agents retry on their own, and the two stack. Each client attempt then spends a full server-side budget.

## The request always wins

We fill a stored field into any request that arrives without it. We never replace a value the request sent.

That rule holds even when the sent value is wrong. An explicit bad `start_within` still returns `400 invalid_start_within`. A key default stands in for a field you didn't send, never for one you sent wrong.

Every response we fill in comes with `x-flexinference-defaults-applied`, listing the fields. A request that sent its own deadline gets no such header.

## A key duration falls back where a request duration fails

A duration in the request body on a `claude-*` model races Claude's cheaper tier. Three rules decide it: managed keys, no streaming, and three minutes or more. Break one and the request fails, with [`400 flex_unsupported_for_anthropic`](/errors#flex_unsupported_for_anthropic) for the first of them. See [Claude durations need a longer window](/deadline-routing#claude-durations-need-a-longer-window).

A duration on the key falls back instead. It runs the `on_no_flex` tier, so the key always has an answer. That fallback is why a key never races Claude's cheaper tier, on managed keys or otherwise: the deadline resolves to your tier before the race is considered.

That fallback covers the model only. A conflict your own request creates still fails. Pinning a cloud route does that, because a cloud route only runs the normal tier. See [`key_default_not_applicable`](/errors#key_default_not_applicable).

## Edit or revoke

Edit the deadline on the key row. Live traffic picks it up within seconds, and you keep the same key. Nothing restarts and the secret stays the same.

Revoking a key clears its defaults with it.

## Where an agent key doesn't apply

A tool needs a base URL and a key field to reach us. A product that runs only against its vendor's own subscription has neither, so no key can reach it.

## Per-tool guides

| Tool                            | Surface it calls |
| ------------------------------- | ---------------- |
| [Codex](/coding-agents)         | Responses        |
| [Cursor](/cursor)               | Chat Completions |
| [Claude Code](/claude-code)     | Messages         |
| [Claude Cowork](/claude-cowork) | Messages         |
| [OpenCode](/opencode)           | Chat Completions |
| [OpenWork](/openwork)           | Chat Completions |
| [OpenScience](/openscience)     | Chat Completions |
| [OpenWorker](/openworker)       | Chat Completions |
| [OpenClaw](/openclaw)           | Chat Completions |

## Troubleshooting & FAQ

[Errors](/errors) carries every refusal we return, with its wire shape, what caused it, and the fix. Each per-tool guide covers the ones specific to that client.

One refusal belongs to agent keys themselves.

**[`400 missing_start_within`](/errors#missing_start_within) on every request.** The key holds no deadline, so it came from **Create key** rather than **Create agent key**. Create a new key with **Create agent key** and swap it in. A key made without defaults can't gain them later, so the row offers no control to add one.

**Does the tool need to know it holds an agent key?** No. It authenticates the same way as any key, and every key starts with `flex_live_`.

**Can one key serve a tool and my own code?** Yes. Your code sends `start_within` and wins. The tool sends nothing and takes the key's deadline.

**What does this cost?** We run every request the agent makes. On your own provider key that costs you nothing here, and your provider bills the tokens. On [Managed Keys](/billing#managed-keys) each request draws your balance, so set a **Request volume** alarm.

**Why did one laptop hit a rate limit?** We cap successful requests per source IP, across every key behind it. A fast loop reaches that before the per-key cap. See [`rate_limit_exceeded`](/errors#rate_limit_exceeded).