1 minute readNewAgent-ready
A sandbox agent can end its own key
An agent on an unclaimed sandbox key can now revoke that key itself when its work is done or the key may have leaked.
An agent that registered itself and never got claimed can now call DELETE /api/me/key (or the MCP tool revoke_my_key) to end its own key. Before, a sandbox key was refused this call, so the only way to retire it was to wait for it to expire or ask a person to claim the workspace first.
The call ends that one key and every token exchanged from it. It reaches no other key and widens nothing else a sandbox key may call.