Docs · runners
Agent tokens vs API keys.
Two different credentials for two different jobs.
Ordel has two kinds of credentials that are easy to confuse:
| API key | Agent token | |
|---|---|---|
| Lives at | Account → API keys | Admin > Integrations > Local Runners |
| Authenticates | You (your user) | A machine (a runner) |
| Grants | Your full role permissions on the REST API and MCP | Only the runner WebSocket: register and receive dispatched runs |
| Typical use | Scripts, CI calling the API, MCP clients (Claude, Cursor) | Headless runner setup where the device login is impractical |
| If leaked | Acts as you, revoke immediately | Can only receive runs as that runner, revoke the one token |
For a laptop you need neither: the one-line install signs the machine in
against your browser session (you confirm a code), and the runner starts on
its own.
Use an agent token (ordel-runner start --server <url> --token oda_... --name <name>)
for CI boxes and other non-interactive machines.