Integration

Hosted API & CLI

Someone else (or you) runs a control-plane against a real Kubernetes cluster; you talk to it with the boxkite CLI or the REST API directly, without ever touching SandboxManager or Kubernetes yourself.

Two credential types, deliberately non-interchangeable

A dashboard session token (a short-lived JWT from POST /v1/auth/signup or /login) is only accepted by /v1/api-keys routes. A long-lived API key (from POST /v1/api-keys, sent as Authorization: Bearer bxk_live_...) is only accepted by /v1/sandboxesroutes. You can't create a key using a key — revoking a leaked one can't be worked around by minting a replacement with it first. The raw key is returned exactly once, at creation, and is never retrievable again.

Sign up and provision an API key

boxkite signup chains signup → login-token → create-api-key into one command and saves the result to ~/.boxkite/config.toml.

terminal

boxkite signup --url https://your-control-plane.example.com
# prompts for --email / --password
# Account created and API key saved for https://your-control-plane.example.com.
# You're ready to run: boxkite session create

Already have a URL and key? Set them directly instead:

terminal

boxkite config set-url https://your-control-plane.example.com
boxkite config set-key bxk_live_...
boxkite config show

What the CLI can do

Every capability has its own page with the exact CLI syntax alongside Python/JS/MCP — the CLI covers all of them:

Sandboxes — boxkite session create/get/ls/rm
Process & exec — boxkite exec
File system — boxkite files view/create/edit/ls/glob/grep
Command allowlist — boxkite allowlist get/set/clear
Secrets — boxkite secrets create/ls/rm
MCP server config — boxkite mcp init <target>

Every session/exec/files command auto-detects the target session if exactly one active session exists; otherwise pass --session <id> explicitly.

Check your account and usage

terminal

boxkite whoami
# email: you@example.com
# account id: 3f9a...
# usage: 2.1/20.0 sandbox-hours this month
# concurrent sandboxes: 1/2

See Rate limits & quotas for what those numbers mean and how they're enforced.

Manage API keys

Unlike session/exec/files, key management needs your dashboard credentials (email + password), not the API key itself — by design, per the credential-separation rule above. These commands prompt for both each time rather than persisting a session.

terminal

boxkite keys ls
boxkite keys rm <key_id>

https only

Every entry point (CLI, both SDKs, the MCP server) refuses a plain http:// base_url except http://localhost/127.0.0.1 — an API key is a full-privilege, long-lived credential, and a non-https URL would put it on the wire in cleartext.