Agents can hand out short-lived child keys for a single job

An agent working with an API key can delegate part of its access to a helper without sharing its own key. The child key only ever carries a subset of what its parent holds, and it ends on its own.

• A child key lasts between 60 seconds and 24 hours, and never longer than the key that created it
• It carries 1 to 20 permissions, never workspace administration, team administration or workspace claiming
• Children can delegate further, up to four levels deep, all inside the same workspace
• Revoking or expiring a parent key, or narrowing its permissions, stops every key below it
• The secret is shown once when the key is created and is not cached
• Dashboard sessions and embed tokens cannot create child keys; only an API key, or a token exchanged from one, can