Dory is in development. The invite-only beta has not opened yet; prices and limits are planned and may change.
Doryby ComputeEngines
Request beta access

Authentication and API keys

Use an API key for the control API and a computer-scoped access token for the data plane. Never send an API key to a preview origin, guest program or third-party page. Keep credentials in your private local environment and redact bearer values, secret URLs and fragments from logs.

API-key authority

Scope Allows
account:read /me, /limits, /classes
computers:read list/get computers, operations, usage, metrics, setup status, SSH info, network, previews, hooks, images
computers:write create, start, stop, restart, resize, patch, network policy, previews, share links, hooks, private images
computers:keepalive extend, pause, resume on computers the key can see (for agents keeping their own computer alive)
computers:exec mint access tokens (POST /computers/{id}/access)
computers:delete delete computers and private images (separate on purpose)
snapshots:read / snapshots:write list and get / create, restore, delete snapshots
billing:read balance, ledger, usage, prices, top-ups, receipts
billing:write create top-up links; retain or strengthen both spend-limit threshold and action: decrease/preserve a finite amount, set a finite amount when none is set, and keep pause or change notify to pause. Raising/removing a finite threshold or changing pause to notify requires fresh console 2-factor verification; otherwise 403 forbidden_scope, even if another field is strengthened
keys:manage API keys only, under the subset rule
ssh_keys:write list, add and remove SSH keys, under the subset rule
events:read the events feed (filtered by the key's restrictions)

Presets: Full (everything except keys:manage, so it includes ssh_keys:write); Agent (computers:read, computers:exec, computers:keepalive, events:read, normally with computer_ids); CI = account:read, computers:read, computers:write, computers:keepalive, computers:exec, snapshots:read, snapshots:write, ssh_keys:write (no delete, billing or keys:manage); Read-only = account:read, computers:read, snapshots:read, billing:read, events:read.

Rotation and descendant authority

  • keys:manage permits get, list, usage, rotation and revocation only of the calling key and its descendants. Same-account keys outside that subtree return 403 key_restricted; another account's keys remain 404. Account-wide key administration is owner-authenticated console authority, not API-key authority.
  • Credential-generation descendants include child API keys and access grants. Immediate rotation/revocation revokes old-generation descendants; overlap caps them at the earlier of their expiry and the overlap deadline. An old-generation secret cannot rotate or revoke its own key (403 key_restricted) or mutate descendants of a newer generation; read/list/usage remain available. Current-generation revocation stays available.
  • A key can mint only keys whose scopes and restrictions are a subset of its own (restrictions are inherited and can only narrow).
  • A key with computer_ids or metadata_selector and ssh_keys:write can add (and remove) SSH keys only for computers it can see; account-wide SSH keys need an unrestricted key with ssh_keys:write. ssh_keys:write cannot mint API keys; that stays with keys:manage.
  • Access tokens carry at most the minting key's rights.
  • Child image permissions must be a subset of the parent's effective private-image permissions; omission never widens them. Ancestor cost attribution and restricted PATCH checks apply independently of visibility.

Console authority is separate

The console uses your password plus an authenticator code (TOTP) or a passkey with user verification. Full sessions expire after 30 idle minutes or 12 hours absolutely. Key issuance, rotation and sensitive security changes need a step-up within five minutes. Adding a factor alone does not revoke all authority; password change or factor replacement applies the specified session/API revocation rules. Logout does not silently become an API-key revocation request.

Recovery/reset/email-change flows are unavailable in the launch definition. Enroll another authenticator before losing the first. See Account setup and Access tokens.

Dory is in development; these pages describe the planned service and may change. Questions: support@computeengines.com.