When you build a computer use agent with Coasty, you need three things: a key to prove who you are, permissions to control machines, and a way to track spend. The prepaid USD wallet gives you full control over costs, while API keys and scopes let you enforce strict security boundaries. This guide covers all three in detail so you can deploy agents safely.
API keys and authentication
Every request to Coasty requires an API key. The server validates the key against your account and checks the requested scopes before allowing access. You provide the key in one of two ways. You can use an Authorization header with Bearer token format, or you can set an X-API-Key header. The key is read from the COASTY_API_KEY environment variable, never hardcoded. If the key is missing or invalid, the server returns a 401 error with a JSON body like {"error":{"code":"invalid_key","message":"Invalid API key","request_id":"..."}}. This ensures you never ship secrets into source control.
curl -v https://coasty.ai/v1/runs \
-H "X-API-Key: $COASTY_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"machine_id": "vm-12345",
"task": "Open Chrome and navigate to cozy.ai",
"cua_version": "v4",
"max_steps": 20
}'Scopes limit what keys can do
- Scopes are attached to each API key. A key with only the machine:provision scope can start and stop a cloud VM but cannot submit a task run. A key with the task:run scope can submit task runs but cannot provision machines. You can create multiple keys with different scopes, so different teams or services can work with the same account without cross-contamination. The server checks scopes on every request and returns a 403 error with {"error":{"code":"insufficient_scope","message":"Missing required scope","request_id":"..."}} if the key lacks permission. This makes it easy to enforce least privilege across your infrastructure.
Read scopes at cozy.ai/developers/keys to verify permissions before deploying.
Prepaid USD wallet and credits
Coasty uses a prepaid USD wallet where 1 credit equals $0.01. You top up the wallet with USD, and the server deducts credits at the rate shown for each operation. Task runs cost $0.05 per agent step. Vision API calls cost $0.05 for predict and $0.03 for ground. Session-based predict costs $0.04. The parse endpoint is free. When you submit a request, the server checks your remaining balance. If credits are insufficient, the server returns a 402 error with {"error":{"code":"insufficient_credits","message":"Insufficient credits","request_id":"..."}} and stops billing. This model prevents unexpected bills and lets you set a hard cap on spend per project.
Where this beats brittle automation
API-only tools often rely on brittle selectors that break when UI changes. Coasty's computer use agent sees the screen just like a human and clicks buttons, types text, and navigates menus by visual context. The prepaid wallet ensures that even if the agent takes many steps, you know exactly how much it will cost. Scopes let you give the agent only the machine:provision and task:run permissions it needs, reducing risk. This approach is more robust than fragile selectors and gives you fine-grained control over both behavior and spend.
With API keys, scopes, and a prepaid USD wallet, you can build production-ready computer use agents that are secure and predictable. Start building at cozy.ai/developers to get your key and explore the documentation.
Want to see this in action?
View Case Studies