Service keys

A service key belongs to your organization and lets a backend act without a user: mint user tokens, run actions as an administrator, create environments, publish domains, release to production from CI. Permission rules do not apply to it.

You do not need it to release: an owner or admin signed in with druntime can make any release, including an environment's first one. The runner that executes your actions never holds your service key; the platform gives it a credential of its own, valid for its environment only, which you never see and which is switched off when the environment is deleted. (Runners set up before environment credentials existed hold the organization key.)

Create one

druntime keys create --name "backend" --env prod-acme-main

Or in the console under Organization → Keys. The key is shown once. Store it as a secret (DOMAIN_SERVICE_KEY), never in the browser and never in git.

Scope

A key is limited to what you choose when you create it:

Prefer the narrowest scope. A key that mints user tokens for production does not need to publish domains.

Use

import { init } from "@domainruntime/platform";
const platform = init({ serviceKey: process.env.DOMAIN_SERVICE_KEY! });

Every request is checked against the key's current state: a revoked key stops working on its next request.

Rotate

Create the new key, deploy it, then revoke the old one:

druntime keys revoke <key-id>