Skip to main content
All Runpod credentials live in one place: the Credentials page in the console. The page has five tabs, one for each credential type. Setting up your credentials before your first deployment will save you time. API keys and SSH keys in particular are required before you can interact with Runpod programmatically or connect to a running Pod.

​
API keys

Legacy API keys generated before November 11, 2024 have either Read/Write or Read Only access to GraphQL based on what was set for that key. All legacy keys have full access to AI API. To improve security, generate a new key with Restricted permission and select the minimum permission needed for your use case.

​
Create an API key

  1. In the Runpod console, navigate to the Credentials page.
  2. Select the API Keys tab and click Create API Key.
  3. Give your key a name and set its permissions (All, Restricted, or Read Only). If you choose Restricted, you can customize access for each Runpod API:
    • None: No access.
    • Restricted: Customize access for each of your endpoints. (Default: None.)
    • Read/Write: Full access to your endpoints.
    • Read Only: Read access without write access.
  4. Click Create, then click your newly-generated key to copy it to your clipboard.
Runpod does not store your API key, so save it somewhere secure (for example, your password manager or a GitHub secret). Treat your API key like a password and don’t share it with anyone.

​
Edit API key permissions

  1. Navigate to the Credentials page and select the API Keys tab.
  2. Click the pencil icon for the key you want to update.
  3. Update the permissions and click Update.

​
Enable or disable an API key

  1. Navigate to the Credentials page and select the API Keys tab.
  2. Click the toggle for the key you want to enable or disable, then click Yes in the confirmation modal.

​
Delete an API key

  1. Navigate to the Credentials page and select the API Keys tab.
  2. Click the trash icon for the key you want to delete.
  3. Click Revoke Key to confirm.

​
S3 API keys

S3 API keys give you access to your network volumes using S3-compatible tools like the AWS CLI and Boto3, without launching a Pod. For full usage instructions, see the S3-compatible API guide.

​
Create an S3 API key

  1. Navigate to the Credentials page and select the S3 API Keys tab.
  2. Click Create an S3 API key.
  3. Give your key a name and click Create.
  4. Copy the access key and secret shown. You’ll need both to configure your S3 client.
Runpod shows your S3 API key secret only once. Save it somewhere secure before closing the dialog.

​
SSH public keys

SSH public keys let you connect to your Pods over SSH from your local machine. In individual and team accounts, all SSH keys in your account are injected into all your Pods. If you add a new key while a Pod is already running, it is injected dynamically without a restart. For full connection instructions, see Connect to a Pod with SSH.

​
Generate an SSH key pair

Run this command in your local terminal, replacing YOUR_EMAIL@DOMAIN.COM with your email:
This saves a public/private key pair to ~/.ssh/id_ed25519.pub and ~/.ssh/id_ed25519.
On Windows Command Prompt (not WSL), the keys are saved to C:\Users\YOUR_USER_ACCOUNT\.ssh\id_ed25519.pub and C:\Users\YOUR_USER_ACCOUNT\.ssh\id_ed25519.

​
Add your public key to Runpod

  1. Run cat ~/.ssh/id_ed25519.pub to display your public key.
  2. Copy the output (it starts with ssh-ed25519).
  3. Navigate to the Credentials page and select the SSH Public Keys tab.
  4. Click Add SSH Key, paste your public key, give it a name, and save.
If you add multiple SSH keys, each key must be on its own line.

​
Container Registry Auth

Container Registry Auth lets you pull private container images when creating a Pod or template. Runpod supports Docker Hub, GitHub Container Registry (GHCR), Amazon ECR, and other registries.

​
Add a credential

  1. Navigate to the Credentials page and select the Container Registry Auth tab.
  2. Click Add Credential.
  3. Enter a name, the registry URL, your username, and your password or access token.
  4. Click Save.
The credential is available when configuring a Pod or template.

​
Secrets

Secrets let you store sensitive values and inject them into Pods without exposing them in plain text. For full usage instructions, see Manage secrets.

​
Create a secret

  1. Navigate to the Credentials page and select the Secrets tab.
  2. Click Add Secret.
  3. Enter a key name and value, then click Save.
Secret keys must start with RUNPOD_SECRET_ — for example, RUNPOD_SECRET_HF_TOKEN. The secret is injected into your Pod as an environment variable with the key name you set.

​
Next steps

Connect to a Pod with SSH

Set up SSH access to your Pods.

S3-compatible API

Use S3 tools to access your network volumes without a Pod.

Manage secrets

Inject secrets into Pods and templates.

Create a custom template

Build reusable container configurations.
Last modified on September 24, 2026