> ## Documentation Index
> Fetch the complete documentation index at: https://boxrouter.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up Your Account

> Create a BoxRouter API key, decide whether your own provider account or Credits pays for compute, and set up your terminal.

You need a BoxRouter API key and a way to pay for sandbox compute. The key authenticates your code.
Pay through your own provider account (BYOK, "bring your own key"), prepaid Credits, or both.

**Before You Begin:** A [BoxRouter dashboard](https://boxrouter.ai/dashboard) account.

## Choose How Compute Is Paid For

| | BYOK | Credits |
| - | - | - |
| Who bills compute | Your provider, on your provider account | BoxRouter, from a prepaid balance |
| Setup | Connect a provider account under **Provider Keys** | Buy Credits under **Credits** |
| BoxRouter's fee on compute | None | None. Credits cost what the provider charges. |

Pick BYOK if you already have a provider account with quota or discounts, and Credits if you want
to start without one. Buying Credits carries a 5% processing fee; see [Credits](https://boxrouter.ai/docs/credits.md#buy-credits).

If you use both, BoxRouter follows each provider's list: keys above Credits first, then Credits, then keys
below Credits. Change that order in [Routing settings](https://boxrouter.ai/docs/routing-settings.md#provider-keys-and-credits-order).

## Set Up

**1. Pay for Compute**

**To use your own provider account (BYOK):** open **Provider Keys**, choose a provider, and enter
its credentials. **Test** checks entered credentials with a read-only request without saving them.
**Save** makes the same check first. Saving or testing a key starts no sandbox in your provider
account, and a saved key does not start preparing BoxRouter's standard image.

Where supported, the first sandbox that needs the image prepares it in your provider account.
Your provider may charge for setup or storage. [Provider keys](https://boxrouter.ai/docs/provider-keys.md)
explains the process.

**To use Credits:** buy them under **Credits**; see [Credits](https://boxrouter.ai/docs/credits.md).

**2. Create an API Key**

Open **API Keys** and create a key. Copy its secret when it is shown, because it cannot be
recovered. The key belongs to the workspace you signed into.

**3. Set It in Your Terminal**

`read -rs` takes the key without echoing it, so it never lands in your shell history. The `export` lasts for this shell session.

```bash theme={"theme":"css-variables"}
printf 'BoxRouter API key: '; read -rs BOXROUTER_API_KEY && export BOXROUTER_API_KEY; printf '\n'
```

The clients call `https://api.boxrouter.ai/api/v1`. To use another deployment, set
`BOXROUTER_BASE_URL` to its base URL, which ends in `/api/v1`.

In the [quickstart](https://boxrouter.ai/docs/quickstart.md), a successful sandbox creation verifies your key. A `401` means the key
was not accepted: check that it is set correctly and has not been revoked.

## Key Permissions

A key's permissions are fixed when you create it. To change them, create a new key.

| Permission | Allows | Where to Set It |
| - | - | - |
| `sandbox:execute` | Create, run commands in, and destroy sandboxes. Every dashboard key has it; the API adds it by default. | **Run Sandboxes**, always on |
| `provider-accounts:manage` | Add, replace, test, and remove BYOK provider keys. Grants no sandbox access. | **Manage Provider Keys (BYOK)** |
| `credentials:manage` | Manage workspace secrets, Credits and spend limits, and view usage. Never exposes provider keys. | **Manage Provider Keys (BYOK)** |

**Manage Provider Keys (BYOK)** appears only for the workspace owner. Use it for CLI automation that connects providers or edits Routing; see the
[provider keys guide](https://boxrouter.ai/docs/provider-keys.md#connect-from-the-cli).

Revoking a key stops new BoxRouter requests, and sandboxes it created then refuse commands from every key.

## If It Fails

| If | Then |
| - | - |
| A credential test fails | Correct the credential at your provider, then test again. |
| `401 unauthenticated` | The key is unset, mistyped, or revoked. Create a new one. |
| `no_eligible_route` | The workspace has no provider key or Credits that fit. Read the error's `fix`. |

## Next Steps

> [card] [Run Your First Sandbox](https://boxrouter.ai/docs/quickstart.md)
>
> Run echo hello in a sandbox and destroy it.

> [card] [Connect a Provider Key](https://boxrouter.ai/docs/provider-keys.md)
>
> Pay with your own provider account instead.

> [card] [Create a Sandbox](https://boxrouter.ai/docs/sandboxes.md)
>
> What a sandbox request can ask for.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.