Dashboard & API keys

The Assemble platform is the hosted side of the SDK: every asm run and asm eval you execute while logged in streams to a workspace dashboard where you and your team can inspect timelines, compare replays, decide approvals, and track quality over time. Nothing about the platform is required — the CLI works fully offline — but a free developer key turns local runs into shared, linkable artifacts.

Sign up on the dashboard, create a developer key, and run asm login. There is no credit card; hosted traces are included with your workspace. You still bring your own model keys — the platform never sees or pays for your model usage.

The platform API lives at https://ingest.getassemble.dev and the dashboard at https://getassemble.dev/app. The CLI and SDK use these by default; override them with ASSEMBLE_BASE_URL and ASSEMBLE_DASHBOARD_URL if you route through a proxy — see CLI configuration.

What the free developer key unlocks#

• Hosted traces for every asm run, with a live-streaming run timeline.
• Uploaded eval results with per-case metrics.
• The approvals inbox for runs paused on an approval policy.
• Replay diff views comparing a replay against its original run.
• Workspace analytics, member management, and shareable read-only run links.

Uploads are redacted by default before they leave your machine — see Security.

Dashboard tour#

Overview#

The workspace home summarizes recent activity and, for new workspaces, walks you through onboarding: create a key, run a workflow, see the trace.

Runs#

The runs list shows every uploaded run in the workspace. Opening a run gives you the run-detail timeline: each agent step, tool call, routing decision, and policy decision in order, with token usage and latency. Runs stream live — start asm run locally and watch events appear as they happen, from run.started through run.completed or run.failed. A non-terminal run that stops sending events shows an amber Stale badge in place of the green Live badge after five quiet minutes — usually a sign the producing process exited before its final trace batch uploaded — and flips back to Live if events resume. From the run detail page you can also create a share link for read-only external viewing.

Replay diff#

When you replay a run, the dashboard renders a side-by-side diff between the original run and the replay — what changed in outputs, latency, and token usage. This is how you verify a prompt or code change against a real recorded run before shipping it.

Approvals inbox#

Runs that hit an approval policy pause and appear in the approvals inbox, where any workspace member can approve or reject with full trace context. Pair it with asm run --wait-approval and the CLI blocks until the decision lands, then resumes the run automatically. See Approvals.

Evals#

Uploaded eval runs get their own list and detail pages showing the suite's metric table and per-case results, so regressions are visible to the whole team, not just the terminal that ran asm eval.

Analytics#

Workspace-level aggregates across your runs — activity and performance over time, at a glance.

Members#

The members page controls who belongs to the workspace. Members can see the workspace's runs and act on its approvals; people outside the workspace see nothing unless you hand them a share link.

Keys#

Create, view (masked), and revoke workspace API keys.

API key management#

Keys come in three environments — dev, prod, and ci — and share one format:

asm_<dev|prod|ci>_<32 hex>_<64 hex>

The middle segment identifies the key; the final segment is the secret.

• Keys are shown once, at creation time. Copy the key immediately; it cannot be retrieved again.
• The platform stores only a hash of the secret, never the raw value. The keys page displays keys masked.
• Revoking a key takes effect immediately: uploads, asm login, and asm whoami with that key are rejected.

Authenticate the CLI with a key and confirm the active workspace:

asm login --key asm_dev_your_key_here
asm whoami

asm login validates the key against the platform before saving it to ~/.assemble/config.json. In CI, prefer the ASSEMBLE_API_KEY environment variable over a config file — see the CLI reference.

Shareable run links#

Any run can be shared as a read-only link so someone without a workspace login — a teammate in another org, a customer, a bug report — can view the trace.

• Share links are scoped to that single run. They grant no access to the rest of the workspace.
• They inherit the redaction applied at upload time. A run uploaded in the default redacted mode shows redacted payloads through the share link too; the link never reveals more than the workspace copy contains.

Note: Redaction happens before upload, so there is no setting on a share link that could expose data the platform never received. See Security.

Workspace isolation#

Every run, trace, eval, and approval belongs to exactly one workspace, and every API key is scoped to a single workspace. Runs from one workspace are never visible to another. Access inside a workspace is governed by the members list; access outside it only ever happens through explicit, single-run share links.