Run an agent without signing in
Give CI or a coding agent its own key for the test environment.
A coding agent in CI or a sandbox has nobody to approve domino login. Give it an automation key instead: an organization key that no person owns, so it keeps working when people leave. It can build, stage and test in the test environment of the projects you choose. Going live still needs a person in Console.
Create a key
Open the API keys settings
In Console, open Settings → API keys. Only organization administrators see Create an automation key.
Choose what the agent may do
- Projects: All projects, which includes projects created later, or Chosen projects.
- Permissions: any of Read, Publish, Inventory, Points, Ingest and Enroll. Pushing code, staging and test members need Publish.
- Create projects: lets the agent start new projects on your plan. A key limited to chosen projects can also work on the projects it creates.
- Expiry: the key never expires unless you choose one.
Save the secret
Select Create automation key. Console shows the secret once. Store it in your CI's or agent's secret settings as RELAY_MANAGEMENT_TOKEN, and keep it out of chat and source control.
Use it
The CLI reads RELAY_MANAGEMENT_TOKEN, so the agent runs the usual commands:
export RELAY_MANAGEMENT_TOKEN=dak_...
domino whoami --json
domino create launch-week --template campaign --json
cd launch-week
npx --yes pnpm@10.34.5 install --frozen-lockfile
# make the changes and commit them
git push
domino stageA project name uses letters, numbers, underscores and hyphens. Use the install command domino create prints in packageManager.installCommand if its pnpm version differs from this example.
domino login --token-stdin saves the key instead, for a machine that keeps a home directory. The Git credential helper domino checkout installs uses the same key, so git push to git.domino.run works without a password prompt.
What it can't do
| Refused | Answer |
|---|---|
| Any change in live, including drafts, previews and secrets | 403 console-approval-required |
| Managing people, roles, personal keys, projects' settings, deletion or transfer | 403 credential-not-allowed |
| Creating any key or approving a CLI sign-in | 403 |
| Creating a project without Create projects | 403 permission-required |
| A project it was not given | 403 scope-mismatch |
It can read live data when it has Read. What each credential may do in live compares it with the other credentials. Staging links it creates also open the test toolbar when the key holds Publish and reaches the project, acting as the key: toolbar actions are audited as the key, and revoking the key, or the secret that created the link, ends the toolbar on its next request.
Rate limits
Domino sets no general limit on how many management calls a key, a project or an organization makes. Test-member calls and attempt reads have no limit of their own, except linking a test member's X account by handle, which counts as an X handle lookup. This is today's behavior, not a promised throughput.
A few calls have their own limits, because each spends a shared outside quota or starts something costly. "Per caller" counts, within one organization, each person once, whichever session or personal key they use, and each automation, service or hosted app key on its own.
| Call | Limit |
|---|---|
| Looking up an X handle, including linking a test member's X account by handle | 30 a minute per caller, 300 an hour per organization |
| Previewing an X search | 6 a minute per caller, 60 an hour per organization |
| Adding, re-checking or removing a domain | 30 an hour per organization, together |
Starting domino dev | 10 a minute per caller |
| Sending feedback | 10 an hour per caller |
| Signing in with a personal key or an AI assistant connection that doesn't exist, such as a mistyped key (expired and revoked ones don't count) | 30 every 10 minutes per network address, counting a whole IPv6 /64 as one, on each Domino server; past it, personal keys and AI assistant connections from that address are refused until the 10 minutes end |
Any call can still be refused when Domino is busy. Wait as long as the answer asks before trying again. The CLI and the SDK already do this within each call's deadline. For a long run, such as a rehearsal with hundreds of test members, keep a fixed number of calls in flight and slow down when calls are refused.
Rotate or revoke
To rotate, select Add secret on the key, move your CI to the new secret, then revoke the old one once its last use stops advancing. Both work until then. Revoke ends the key and every secret on the next request. Creating, rotating and revoking keys appear in each project's access history.