Set Up Your Account

You need a BoxRouter API key and a way to pay for sandbox compute. The key authenticates your code. Pay through your own provider account (BYOK, “bring your own key”), prepaid Credits, or both. Before You Begin: A BoxRouter dashboard account.

Choose How Compute Is Paid For

	BYOK	Credits
Who bills compute	Your provider, on your provider account	BoxRouter, from a prepaid balance
Setup	Connect a provider account under Provider Keys	Buy Credits under Credits
BoxRouter’s fee on compute	None	None. Credits cost what the provider charges.

Pick BYOK if you already have a provider account with quota or discounts, and Credits if you want to start without one. Buying Credits carries a 5% processing fee; see Credits. If you use both, BoxRouter follows each provider’s list: keys above Credits first, then Credits, then keys below Credits. Change that order in Routing settings.

Set Up

Pay for Compute

To use your own provider account (BYOK): open Provider Keys, choose a provider, and enter its credentials. Test checks entered credentials with a read-only request without saving them. Save makes the same check first. Saving or testing a key starts no sandbox in your provider account, and a saved key does not start preparing BoxRouter’s standard image.Where supported, the first sandbox that needs the image prepares it in your provider account. Your provider may charge for setup or storage. Provider keys explains the process.To use Credits: buy them under Credits; see Credits.

Create an API Key

Open API Keys and create a key. Copy its secret when it is shown, because it cannot be recovered. The key belongs to the workspace you signed into.

Set It in Your Terminal

read -rs takes the key without echoing it, so it never lands in your shell history. The export lasts for this shell session.

printf 'BoxRouter API key: '; read -rs BOXROUTER_API_KEY && export BOXROUTER_API_KEY; printf '\n'

The clients call https://api.boxrouter.ai/api/v1. To use another deployment, set BOXROUTER_BASE_URL to its base URL, which ends in /api/v1.

In the quickstart, a successful sandbox creation verifies your key. A 401 means the key was not accepted: check that it is set correctly and has not been revoked.

Key Permissions

A key’s permissions are fixed when you create it. To change them, create a new key.

Permission	Allows	Where to Set It
`sandbox:execute`	Create, run commands in, and destroy sandboxes. Every dashboard key has it; the API adds it by default.	Run Sandboxes, always on
`provider-accounts:manage`	Add, replace, test, and remove BYOK provider keys. Grants no sandbox access.	Manage Provider Keys (BYOK)
`credentials:manage`	Manage workspace secrets, Credits and spend limits, and view usage. Never exposes provider keys.	Manage Provider Keys (BYOK)

Manage Provider Keys (BYOK) appears only for the workspace owner. Use it for CLI automation that connects providers or edits Routing; see the provider keys guide. Revoking a key stops new BoxRouter requests, and sandboxes it created then refuse commands from every key.

If It Fails

If	Then
A credential test fails	Correct the credential at your provider, then test again.
`401 unauthenticated`	The key is unset, mistyped, or revoked. Create a new one.
`no_eligible_route`	The workspace has no provider key or Credits that fit. Read the error’s `fix`.

Next Steps

Run Your First Sandbox

Run echo hello in a sandbox and destroy it.

Connect a Provider Key

Pay with your own provider account instead.

Create a Sandbox

What a sandbox request can ask for.

Get Started

Sandboxes

Routing and Providers

Errors and Limits

Cost and Billing

Security and Privacy

Clients