API Keys, Scopes, and the Prepaid USD Wallet Explained
You need a way to secure credentials and control who can do what with your computer use agent. You also need to pay for each step and keep spending predictable. The Coasty platform gives you scoped API keys and a prepaid USD wallet that ties usage directly to credits. This guide shows how to set up keys, assign permissions, and manage a wallet.
API keys and scopes
Keys are created at https://coasty.ai/developers/keys and stored in an environment variable like COASTY_API_KEY. You send them with the header X-API-Key: <key> or Authorization: Bearer <key>. Scopes gate which endpoints you can use. For example, a key with read-only scope cannot POST /v1/runs or POST /v1/workflows. If you try to use an endpoint outside your scope you get a 403 INSUFFICIENT_SCOPE error. Always test scopes by calling an endpoint you do not have access to to confirm the behavior.
curl -X GET https://coasty.ai/v1/runs \
-H "X-API-Key: $COASTY_API_KEY"Prepaid USD wallet and billing
- ●Billing is based on a prepaid USD wallet. 1 credit = $0.01 USD.
- ●Task runs charge $0.05 per agent step when you call POST /v1/runs.
- ●Vision calls cost $0.05 for POST /v1/predict and $0.04 for POST /v1/sessions/{id}/predict.
- ●Grounding calls cost $0.03 for POST /v1/ground.
- ●POST /v1/parse is free and does not consume credits.
- ●You can view wallet status on the dashboard and inspect the wallet from the API if you have the right scope.
- ●Insufficient credits trigger a 402 INSUFFICIENT_CREDITS error when you try to start a run.
A prepaid wallet lets you set a budget upfront and avoid surprise bills.
Webhooks and idempotency
Webhooks are signed with an HMAC header Coasty-Signature: t=unix,v1=hex. You can verify the payload by recomputing the HMAC with your secret. Idempotency-Key headers make writes safe to retry. If you resend a POST /v1/runs or POST /v1/workflows request with the same key the server returns the same result without charging again. This is useful for retries and for idempotent workflows that must complete exactly once.
import os
import hmac
import hashlib
import json
from datetime import datetime
api_key = os.getenv("COASTY_API_KEY")
webhook_secret = os.getenv("COASTY_WEBHOOK_SECRET")
# Simple HMAC verification
def verify_signature(payload: bytes, ts: str, signature: str) -> bool:
expected = hmac.new(
webhook_secret.encode(),
payload + ts.encode(),
hashlib.sha256
).hexdigest()
return hmac.compare_digest(signature, expected)
# Example: verify a webhook payload
body = json.dumps({"run_id": "abc123"}).encode()
ts = str(int(datetime.utcnow().timestamp()))
sig = os.getenv("COASTY_WEBHOOK_SIGNATURE")
if verify_signature(body, ts, sig):
print("Signature valid")
else:
print("Signature invalid")Where this beats brittle automation
With API keys and scopes you can give different teams read-only access to runs without letting them provision machines or start new workflows. The prepaid wallet makes it simple to cap monthly spend by loading credits in advance. Webhooks give you real-time events without polling. An MCP server lets you drive Coasty from Cursor, Claude Desktop, or other MCP clients. All of this fits together in a secure, predictable system that avoids hardcoding secrets and guessing costs.
Secure your computer use API keys with scoped permissions and manage billing with a prepaid USD wallet. Start building workflows and runs today. Get your key at https://coasty.ai/developers.