[dazip]

fal keys create --preset and the interactive picker now offer BILLING, COMPUTE, SERVERLESS and AGENT alongside FULL, API, DEPLOY and READONLY. AGENT keys only work on accounts with Agent access.

Why: #1185 shipped only four of the server's eight presets, so the CLI lagged the dashboard and Platform API and the rest were reachable only by spelling out each permission.

Refs: PROD-3005, follow-up to #1185

🤖 Generated with Claude Code

---

Note

Low Risk
Additive CLI/SDK enum and help text; key minting behavior is unchanged aside from exposing additional preset names the server already supports.

Overview
Adds four server-side key permission presets to the Python SDK and fal keys CLI so users can mint BILLING, COMPUTE, SERVERLESS, and AGENT keys via --preset or the interactive picker, with short descriptions for each (AGENT notes it requires Agent access on the account).

KeyPreset in the SDK gains the new enum values; key creation still sends them as policy_preset (no legacy v1 scope), and the inline comment now states that only FULL and API map to scope. Unit tests cover CLI parsing for the new presets and keep PRESET_DESCRIPTIONS in sync with every KeyPreset member.

^{Reviewed by Cursor Bugbot for commit a90b310. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

PROD-3005

[dazip]

E2E against prod (SDK + CLI, all passing)

• Mint: all eight presets (FULL, API, DEPLOY, READONLY, BILLING, COMPUTE, SERVERLESS, AGENT) plus custom permission lists and deprecated --scope API.
• Grants: each key was probed on apps, secrets, runners, key listing and key creation; every allow/deny matched the server's preset definitions (e.g. BILLING can list keys but not create them; COMPUTE can list runners only).
• CLI: --preset SERVERLESS and --preset READONLY mint working keys with the expected grants.

[claude]

Looks good, straightforward additive change.

What was reviewed: the new BILLING/COMPUTE/SERVERLESS/AGENT enum members and their PRESET_DESCRIPTIONS entries, confirming no other code path hardcodes the old preset list (CLI picker, choices, and create logic all iterate KeyPreset generically); the existing test_every_preset_has_a_description test already guards against a missing description causing a KeyError in the interactive picker; and the comment/test updates in sdk.py and test_keys.py accurately generalize from "DEPLOY/READONLY" to "presets other than FULL and API," matching the code (policy_preset is sent as a raw string, validated server-side).

Extended reasoning...

The change only adds four enum values and matching descriptions, plus a comment/test generalization; it touches no auth/crypto logic directly since preset validation happens server-side and the CLI merely forwards the preset name as a string. No other call site hardcodes the preset set, and a pre-existing test enforces every KeyPreset has a description, so the addition can't silently break the interactive picker. The diff is small, mechanical, and fully covered by updated tests, which is why this is a safe approve.