Budgets and sub-keys

A key's policy is checked before every create and enforced by the reconciler during runs. Sub-keys let you derive a narrower key from your own, so the agent never holds anything wider than it needs.

Mint a sub-key

From the dashboard (API keys → Create sub-key), the CLI, or the API with session auth:

briq keys create --name "claude-code laptop" --parent bq_live_… \
  --daily-cap 200 --max-concurrent 2 --sizes nano,small --max-ttl 120

curl -X POST https://api.briq.run/v1/keys \
  -H "Cookie: …session…" -H "Content-Type: application/json" \
  -d '{
    "name": "claude-code laptop",
    "parent": "key_…",
    "policy": {
      "dailySpendCapCents": 200,
      "maxConcurrentBriqs": 2,
      "allowedSizes": ["nano", "small"],
      "maxTtlMinutes": 120
    }
  }'

Anything not set is inherited. Anything wider than the parent is rejected:

{ "error": { "code": "policy_violation", "message": "sub-key widens parent policy: allowedSizes" } }

Suggested budgets

At €0.03 per hour for small, a €2 cap is about 66 machine-hours per day. It is not there to save money; it is there to make an infinite loop finite.

What the agent sees

briq_quota returns the remaining spend and concurrency, so a well-behaved model plans its work inside the budget. When a cap is hit, briq_run fails with quota_exceeded and a message the model can relay to you. The reconciler stops the key's briqs when the daily cap is crossed mid-run.

Rotate and revoke

Sub-keys can be revoked individually from the dashboard without touching the parent. Set expiresAt on keys you hand to short-lived environments. Every call is attributed to its key in the audit log, filterable by key, action and briq, exportable as CSV.