Manage credentials

Create and manage your API keys, SSH keys, S3 API keys, container registry credentials, and secrets from the Credentials page.

All Runpod credentials live in one place: the Credentials page in the console. The page has five tabs, one for each credential type.

Credential	What it’s for
API keys	Authenticate requests to the Runpod API, CLI, and SDKs.
S3 API keys	Access network volumes using S3-compatible tools.
SSH public keys	Connect to Pods over SSH from your local machine.
Container Registry Auth	Pull private container images when creating a Pod or template.
Secrets	Store sensitive values to inject into Pods without exposing them in plain text.

Setting up your credentials before your first deployment will save you time. API keys and SSH keys in particular are required before you can interact with Runpod programmatically or connect to a running Pod.

---

API keys

API keys authenticate your identity when making requests to Runpod. You’ll need one any time you interact with Runpod outside the web console, for example when using the Runpod CLI, the Python SDK, or making direct REST or GraphQL API calls.

Runpod API keys support three permission levels, which let you limit what a key can do. This is useful if you want to give a key to a script or external tool without granting it full control over your account.

Legacy API keys generated before November 11, 2024 have either Read/Write or Read Only access to GraphQL based on what was set for that key. All legacy keys have full access to the AI API. To improve security, generate a new key with Restricted permission and select the minimum access needed for your use case.

Create an API key

1. Go to the Credentials page and select the API Keys tab.
2. Select + Create API Key.
3. Give your key a name and set its permissions:
   • All: Full access to all Runpod APIs. Use this for personal scripts or trusted tools.
   • Restricted: Customize access per Serverless endpoint. For each endpoint, choose one of the following:
     • None: No access.
     • Read/Write: Full access.
     • Read Only: Read access without write access.
   • Read Only: Read access across all APIs without the ability to create, modify, or delete resources. Useful for monitoring or observability integrations.
4. Select Create, then select the key to copy it to your clipboard.

Runpod does not store your API key after creation. Save it somewhere safe, for example in your password manager or as a GitHub Actions secret. Treat it like a password: never share it or commit it to a public repository.

Edit API key permissions

You can change a key’s permissions at any time without regenerating it.

1. On the API Keys tab, select the pencil icon next to the key you want to update.
2. Update the permissions and select Update.

Enable or disable an API key

Disabling a key temporarily blocks all requests authenticated with it, without deleting it. This is useful if you suspect a key has been compromised but aren’t ready to revoke it permanently.

On the API Keys tab, select the toggle for the key, then confirm in the dialog.

Delete an API key

Deleting a key is permanent. Any integration or script using it will immediately lose access.

On the API Keys tab, select the trash icon for the key, then select Revoke Key to confirm.

---

S3 API keys

S3 API keys give you access to your network volumes through any S3-compatible tool, such as the AWS CLI, boto3, or rclone. This lets you upload, download, and manage files on your network volumes directly from your local machine, without needing to start a Pod first.

S3 API keys are separate from your Runpod API keys because they use the AWS S3 authentication format. Tools that speak S3 expect a specific credential structure (an access key ID and a secret), so Runpod issues a dedicated key type for this purpose.

Create an S3 API key

1. Go to the Credentials page and select the S3 API Keys tab.
2. Select Create an S3 API key, give it a name, and select Create.
3. Save the access key (e.g., user_***...) and secret (e.g., rps_***...). You’ll enter these into your S3 tool of choice during setup.

Runpod shows your S3 key secret only once. Copy and save it before closing the dialog — you cannot retrieve it afterward.

For full setup and usage instructions, including AWS CLI configuration and code examples, see S3-compatible API.

---

SSH public keys

SSH public key authentication lets you connect to a Pod from your local terminal using a secure key pair instead of a password. It is the recommended connection method because it is more secure, does not require you to remember a password, and can be automated.

You generate a key pair on your local machine. The private key stays on your machine, and you share the public key with Runpod. When you start a Pod, Runpod injects your public key into it. When you connect, your SSH client uses your private key to prove your identity without ever sending a password over the network.

Generate an SSH key pair

If you don’t already have an SSH key, run this command in your local terminal, replacing the email address with your own:

ssh-keygen -t ed25519 -C "[e-mail]"

This creates two files:

• ~/.ssh/id_ed25519: Your private key. Keep this on your machine and never share it.
• ~/.ssh/id_ed25519.pub: Your public key. This is what you add to Runpod.

If you’re using Windows Command Prompt instead of WSL or a Linux terminal, the keys are saved to C:\Users\YOUR_USER_ACCOUNT\.ssh\ instead.

Add your SSH public key to Runpod

1. Run cat ~/.ssh/id_ed25519.pub to print your public key to the terminal.
2. Copy the output in full. It starts with ssh-ed25519 and ends with your email.
3. Go to the Credentials page and select the SSH Public Keys tab.
4. Paste the key and save.

If you add multiple SSH keys, place each key on its own line. Pasting the key fingerprint (which starts with SHA256:) instead of the public key itself is a common mistake and will cause authentication to fail.

Once saved, your key is automatically injected into every Pod you start. For full connection instructions, see Connect to a Pod with SSH.

---

Container Registry Auth

By default, Runpod can pull any public container image when starting a Pod or creating a template. If your image is hosted in a private registry, you need to add a registry credential so Runpod has permission to pull it. Private registries include Docker Hub private repositories, GitHub Container Registry, and AWS ECR.

Once added, the credential appears as a selectable option in the dropdown when you create or edit a template.

Add a container registry credential

1. Go to the Credentials page and select the Container Registry Auth tab.
2. Select + Add credential.
3. Give the credential a name you’ll recognize, select the registry type, and enter your registry username and password or access token.
4. Select Save.

You can add multiple credentials for different registries, and edit or remove them at any time using the pencil and trash icons in the credential list.

---

Secrets

Secrets are encrypted key-value pairs for storing sensitive information that your Pods and Serverless workers need at runtime: API tokens, database passwords, model access tokens, and service credentials.

The key difference between a secret and a regular environment variable is that a secret’s value is encrypted at rest and never displayed in plain text after creation. You reference it in your template configuration by name, and Runpod substitutes the actual value when the Pod starts:

{{ RUNPOD_SECRET_secret_name }}

For example, if you’re running a model that requires a Hugging Face token, you’d store the token as a secret named huggingface_token and reference it in your template like this:

HF_TOKEN={{ RUNPOD_SECRET_huggingface_token }}

The token never appears in your template, your Pod logs, or anywhere visible in the console.

Create a secret

1. Go to the Credentials page and select the Secrets tab.
2. Select + Create secret.
3. Enter a name (e.g., openai_api_key), the secret value, and an optional description.
4. Select Create Secret.

Once a secret is created, its value cannot be viewed again through the console. If you need to change it, edit the secret to set a new value.

For full usage instructions, including how to reference secrets in templates and best practices, see Manage secrets.

---

Next steps

• Connect to a Pod with SSH: Use your SSH key to access a running Pod from your terminal.
• S3-compatible API: Configure your S3 API key and start transferring files to and from network volumes.
• Manage secrets: Learn how to reference secrets in templates and follow security best practices.
• Create a custom template: Use your container registry credential when building a template from a private image.