API keys

Use API keys for CI and other non-interactive clients. Use browser sign-in for human sessions. Keys can also be created, rotated, and revoked in the Mount Thor portal.

Create a key

mthr keys create --display-name build-agent

The default scopes are sessions:write, access:write, compute:read, compute:session, and compute:write — enough for compute automation. For a narrower key, set --scopes explicitly:

mthr keys create \
  --display-name vm-runner \
  --scopes "compute:read,compute:session,compute:write"

compute:session is required for SSH, desktop, and port-forward grants. Add account:read for account reads such as mthr whoami, and billing:read for billing reads. Neither is included by default. Set an expiry when the key has a fixed lifetime:

mthr keys create \
  --display-name release-job \
  --expires-at "2026-12-31T00:00:00Z"

The plaintext key is shown once. Store it in a secret manager, then expose it to mthr as MOUNTTHOR_API_KEY:

export MOUNTTHOR_API_KEY="mthr_live_..."

When both a stored browser session and MOUNTTHOR_API_KEY are present, the API key takes precedence.

List and update keys

mthr keys ls
mthr keys update build-agent \
  --scopes "sessions:write,compute:read,compute:session"

Updating scopes replaces the current set.

Delete a key

mthr keys delete build-agent

Delete unused or exposed keys immediately.

Compute

Platform

API Reference

Create a key

List and update keys

Delete a key

​Create a key

​List and update keys

​Delete a key

Create a key

List and update keys

Delete a key