diff --git a/README.md b/README.md
index 7c5aed6..17065ac 100644
--- a/README.md
+++ b/README.md
@@ -105,13 +105,15 @@ make e2e                   # optional: the end-to-end tests
 images from the [latest release](https://github.com/different-ai/differently/releases).
 
 Then call it from code ([TypeScript](sdk/typescript), [Python](sdk/python),
-[Go](pkg/client)):
+[Go](pkg/client)). The SDKs are not on npm or PyPI yet; each README says how
+to install it from this repository.
 
 ```ts
 import { Differently } from "@differently/sdk";
 
 const differently = new Differently({ apiKey: process.env.DIFFERENTLY_API_KEY });
 const sandbox = await differently.sandboxes.create({
+  // projectId: "prj_default", // needed with an operator key, such as the dev token
   profile: "small",
   placement: { strategy: "private-first", external: "never" },
 });
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 025bd03..a6c8490 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -8,11 +8,16 @@ picks the pool; the SDK never needs to know which backend runs the sandbox.
 
 ## Install
 
+The SDK is not on PyPI yet. Install it from this repository:
+
 ```sh
-pip install differently
+pip install "git+https://github.com/different-ai/differently.git#subdirectory=sdk/python"
 ```
 
-Until the package is published, install from a checkout: `pip install ./sdk/python`.
+or from a checkout: `pip install ./sdk/python`.
+
+Do not run `pip install differently`: that name on PyPI belongs to an
+unrelated project.
 
 ## Quickstart
 
@@ -104,12 +109,12 @@ and other POSTs are never retried.
 | `Sandbox` handle | `exec`, `exec_stream`, `files.list/read/read_text/write`, `stop`, `start`, `pause`, `resume`, `snapshot`, `fork`, `expose_port`, `explain_placement`, `refresh`, `update`, `wait`, `delete` |
 | `snapshots` | `list`, `get`, `delete` |
 | `projects` | `list`, `create`, `get`, `delete` |
-| `api_keys` | `list`, `create`, `revoke` |
+| `api_keys` | `list`, `create`, `get`, `rotate`, `revoke` |
 | `quotas`, `usage` | `get` |
 | `audit_events` | `list`, `iterate` |
 | `policies` | `list`, `put`, `delete` |
 | `capabilities`, `profiles`, `templates`, `classifications` | `list` |
-| `admin` | `organizations.{list,create,get,update,suspend,resume}`, `projects.set_quota`, `pools.{list,get,create,update,drain,undrain,delete}`, `agents.list`, `trust_report`, `verify_audit`, `terminate_sandbox`, `reconcile` |
+| `admin` | `organizations.{list,create,get,update,suspend,resume}`, `projects.set_quota`, `pools.{list,get,create,update,drain,undrain,use,delete}`, `secrets.{list,put,delete}`, `trust_report`, `verify_audit`, `terminate_sandbox`, `reconcile` |
 | client | `me`, `version` |
 
 Keyword arguments are snake_case. Records come back as plain dicts keyed exactly
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index d84b106..385ae9a 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -8,13 +8,15 @@ picks the pool; the SDK never needs to know which backend runs the sandbox.
 
 ## Install
 
+The SDK is not on npm yet (`npm install @differently/sdk` finds nothing).
+Build it from a checkout of this repository and install that folder:
+
 ```sh
-npm install @differently/sdk
+git clone https://github.com/different-ai/differently.git
+(cd differently/sdk/typescript && npm ci && npm run build)
+npm install ./differently/sdk/typescript
 ```
 
-Until the package is published, install from a checkout:
-`npm install ./sdk/typescript` (run `npm run build` there first).
-
 ## Quickstart
 
 ```ts
@@ -96,12 +98,12 @@ POSTs are never retried.
 | `Sandbox` handle | `exec`, `execStream`, `files.list/read/readText/write`, `stop`, `start`, `pause`, `resume`, `snapshot`, `fork`, `exposePort`, `explainPlacement`, `refresh`, `update`, `wait`, `delete` |
 | `snapshots` | `list`, `get`, `delete` |
 | `projects` | `list`, `create`, `get`, `delete` |
-| `apiKeys` | `list`, `create`, `revoke` |
+| `apiKeys` | `list`, `create`, `get`, `rotate`, `revoke` |
 | `quotas`, `usage` | `get` |
 | `auditEvents` | `list`, `iterate` |
 | `policies` | `list`, `put`, `delete` |
 | `capabilities`, `profiles`, `templates`, `classifications` | `list` |
-| `admin` | `organizations.{list,create,get,update,suspend,resume}`, `projects.setQuota`, `pools.{list,get,create,update,drain,undrain,delete}`, `agents.list`, `trustReport`, `verifyAudit`, `terminateSandbox`, `reconcile` |
+| `admin` | `organizations.{list,create,get,update,suspend,resume}`, `projects.setQuota`, `pools.{list,get,create,update,drain,undrain,use,delete}`, `secrets.{list,put,delete}`, `trustReport`, `verifyAudit`, `terminateSandbox`, `reconcile` |
 | client | `me`, `version` |
 
 `list` returns one page (`{ items, nextCursor }`); `iterate` walks every page.