langchain-ai/deepagents · error · RuntimeError

Runloop rejected the credentials; check RUNLOOP_API_KEY (or

Error message

Runloop rejected the credentials; check RUNLOOP_API_KEY (or DEEPAGENTS_CODE_RUNLOOP_API_KEY): {e}

What it means

Raised when Runloop's API returns `AuthenticationError` or `PermissionDeniedError` during devbox/blueprint creation, translated into a `RuntimeError` that names the credential env vars to check (`RUNLOOP_API_KEY` or its `DEEPAGENTS_CODE_` prefixed override). It means the bearer token is missing, invalid, revoked, or lacks permission for the requested operation.

Source

Thrown at libs/partners/runloop/langchain_runloop/provider.py:213

        env_blueprint_name = self._resolve_env("RUNLOOP_SANDBOX_BLUEPRINT_NAME")
        blueprint_name = snapshot or env_blueprint_name
        use_blueprint = env_blueprint_id is not None or blueprint_name is not None

        try:
            if use_blueprint:
                devbox = self._create_from_blueprint(
                    blueprint_id=env_blueprint_id,
                    blueprint_name=blueprint_name,
                    dockerfile=dockerfile,
                )
            else:
                devbox = self._sdk.devbox.create()
        except (AuthenticationError, PermissionDeniedError) as e:
            msg = (
                "Runloop rejected the credentials; check RUNLOOP_API_KEY "
                f"(or DEEPAGENTS_CODE_RUNLOOP_API_KEY): {e}"
            )
            raise RuntimeError(msg) from e
        except (APIConnectionError, APITimeoutError) as e:
            msg = f"Runloop API unreachable (transient — safe to retry): {e}"
            raise RuntimeError(msg) from e
        except Exception as e:
            target = blueprint_name or env_blueprint_id or "devbox"
            msg = f"Failed to create Runloop devbox from '{target}': {e}"
            raise RuntimeError(msg) from e

        return RunloopSandbox(devbox=devbox)

    def _create_from_blueprint(
        self,
        *,
        blueprint_id: str | None,
        blueprint_name: str | None,
        dockerfile: str,
    ) -> Devbox:
        if blueprint_id is not None:

View on GitHub (pinned to a1af029e6e)

Solutions

Print/verify the key source: check whether `DEEPAGENTS_CODE_RUNLOOP_API_KEY` is set and overriding `RUNLOOP_API_KEY` (note: empty values are treated as unset).
Generate a fresh API key in the Runloop dashboard and export it: `export RUNLOOP_API_KEY=rl_...`.
Strip whitespace/quotes from the key value in your shell profile or CI secrets.
Confirm the key belongs to the org/project you are targeting and has devbox-create permissions.
Retry after fixing; if it persists, test the key with a direct SDK/HTTP call to isolate the provider.

Example fix

// before
export RUNLOOP_API_KEY="stale-revoked-key"

// after
unset DEEPAGENTS_CODE_RUNLOOP_API_KEY
export RUNLOOP_API_KEY="rl_live_valid_key"
provider = RunloopProvider(api_key=os.environ["RUNLOOP_API_KEY"])

Defensive patterns

Strategy: validation

Validate before calling

import os, re

def has_api_key() -> bool:
    key = os.environ.get("DEEPAGENTS_CODE_RUNLOOP_API_KEY") or os.environ.get("RUNLOOP_API_KEY")
    return bool(key and key.strip())

Type guard

def is_plausible_runloop_key(key: str | None) -> bool:
    return bool(key) and key == key.strip() and len(key) >= 20

Try / catch

try:
    sandbox = provider.get_or_create()
except RuntimeError as e:
    if "credentials" in str(e):
        raise SystemExit("Fix RUNLOOP_API_KEY (or DEEPAGENTS_CODE_RUNLOOP_API_KEY) and retry") from e
    raise

Prevention

Check startup that exactly one of RUNLOOP_API_KEY / DEEPAGENTS_CODE_RUNLOOP_API_KEY is set to a valid value.
Never commit keys; load from a secrets manager in CI and verify injection succeeded.
Strip whitespace and quotes when reading keys from env files.
Rotate keys on a schedule and update all environments; test the key with a cheap API call at boot.

When it happens

Trigger: `get_or_create` (create path, with or without a blueprint) where the configured API key is wrong, expired, unset-but-nonempty garbage, or the key's account is not allowed to create devboxes/blueprints.

Common situations: Copy-pasted key with whitespace or truncation; key rotated or revoked; using a production key against a different org/project; the `DEEPAGENTS_CODE_RUNLOOP_API_KEY` override shadowing a valid `RUNLOOP_API_KEY` (or vice versa); CI secrets not injected.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/28a6e44f3b1ed664. Report an issue: GitHub.