> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Direct mode

> LaunchKit calls your E2B-compatible plane directly

In direct mode the LaunchKit cloud speaks the E2B API straight to your plane. There is nothing for you to run; setup is an exchange of connection details.

## Prerequisites

* An E2B-compatible control plane **reachable from the LaunchKit cloud over HTTPS**.
* The plane's **API URL or domain**, and its **API key**.
* If the plane sits behind an IP allowlist, contact LaunchKit for the current egress origins to permit.

## What you hand your LaunchKit contact

| Detail                | Notes                                                                                                                                                              |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| API URL **or** domain | One of the two is required; the API URL wins when both are set                                                                                                     |
| API key               | Entered directly into the workspace console by an operator, never sent in files or bundles                                                                         |
| Key-validation flag   | Planes whose keys are not in E2B's `e2b_...` format (CubeSandbox uses `sk-cube-...`) need key validation disabled; see [Compatibility](/en/runtimes/compatibility) |

## How your key is protected

The API key is stored as an **AWS KMS envelope** (encrypted data key plus ciphertext), cryptographically bound to your workspace and this specific runtime record. It is entered through the console UI only, is never exported, and rotation is a re-entry: hand over the new key, the operator replaces it, and the probe re-runs.

## The conformance probe

After the key is entered, LaunchKit runs a live probe against your plane: create a sandbox, execute a command, pause, kill, and check whether the plane supports template builds. The runtime flips to `connected` only when the probe passes, and re-validation can be run at any time.

<Note>
  With key validation disabled (the CubeSandbox case), the probe verifies **reachability and API conformance** rather than key authenticity, and records that scope honestly on the runtime. A `connected` status then means "the plane responds correctly", not "the key was independently validated".
</Note>

## Failure behavior

If your plane becomes unreachable or the key is rotated away, the next probe or task attempt marks the runtime `error` with the failure message, and tasks on this runtime fail loudly rather than migrating anywhere else.