You need an API key to authenticate to the FC Agent Sandbox data plane. Before you connect through the E2B SDK, the E2B CLI, or direct FC Agent Sandbox data plane calls, create an API key in the Function Compute console and pass it to your local or runtime environment through environment variables.
Prerequisites
Before you create an API key, make sure that:
Function Compute is activated for your account.
FC Agent Sandbox is activated for your account.
Your Alibaba Cloud account or RAM user has permission to manage FC Agent Sandbox API keys.
Create an API key
Open the FC Agent Sandbox API Keys page.
On the API key management page, click Create API Key.
In the creation panel, enter a description and set an expiration time.
Description: identifies the purpose of the API key, such as development, production, a specific application, or a specific team. Use a traceable name instead of a generic value such as
testordefault.Expiration time: you can choose no expiration or define a custom expiration time. For production, set an explicit expiration and establish a rotation mechanism.
Click OK.
After the key is created, copy the full API key value and store it securely.
Important: Do not put API keys in source repositories, images, templates, logs, screenshots, support tickets, or frontend pages. If a key is exposed, disable or reset it immediately.
Use the API key with SDKs and the CLI
When you connect to FC Agent Sandbox through the E2B SDK, pass the API key, API URL, and domain through environment variables:
export E2B_API_KEY="<your-api-key>"
export E2B_API_URL="https://api.<region>.e2b.fc.aliyuncs.com"
export E2B_DOMAIN="<region>.e2b.fc.aliyuncs.com"New E2B CLI versions authenticate with E2B_API_KEY. E2B_ACCESS_TOKEN is a deprecated legacy E2B authentication variable and should not be used in new integration flows. If an older CLI still asks for it, upgrade the CLI and retry.
<region> must match the region where FC Agent Sandbox is deployed. If the API key, API URL, domain, template, and sandbox do not belong to the same account or region, authentication, template discovery, sandbox creation, or connection can fail.
View and manage API keys
On the API keys page, you can view the masked API key value, description, account ID, status, creation time, and expiration time, and filter keys by status or description keywords.
Supported management operations:
Edit: update the description or expiration time, or enable or disable the API key.
Reset: generate a new API key value. After a reset, the old value stops working and applications that still use it will fail authentication.
Delete: disable the API key before deleting it. Disable it first, observe for a period of time, and delete it only after confirming that no application still depends on it.
Security recommendations
Separate API keys by application, environment, team, or tenant. Do not share one long-lived key across multiple people or systems.
In production, prefer custom expiration times and rotate keys regularly.
Before you reset or delete a key, confirm that the application has already switched to a replacement key.
If you suspect a leak, disable or reset the key first, and then investigate the source of the exposure.
If you need SDK configuration details, continue with Use FC Agent Sandbox with the SDK. For full connection parameters, see E2B SDK Connection Parameters.