API keys for scripts and integrations

API keys let scripts and integrations reach the management API (/api/*) without a shared operator password. Manage them on the API Keys page.

How keys authenticate

Send the key in the X-Api-Key header. In PowerShell on the server:

Invoke-RestMethod -Uri http://127.0.0.1:5000/api/protection-status -Headers @{ 'X-Api-Key' = 'pwk_xxxxxxxx…' }

With curl (in Windows PowerShell, type curl.exe: plain curl there is a different command):

curl.exe -H "X-Api-Key: pwk_xxxxxxxx…" http://127.0.0.1:5000/api/protection-status

The console's own access and any keys set in server configuration are separate bootstrap keys — they keep working and cannot be revoked here, so the console can never lock itself out.

Creating a key

1. Go to API Keys.
2. Enter a name (what it's for, e.g. deploy-ci), pick a role, and — for a Tenant key — a tenant id.
3. Click Create key.
4. Copy the key now. The full key is shown exactly once; only its hash and a short prefix are stored, so it cannot be shown again. If you lose it, revoke it and make another.

Roles

Managing keys

• The table shows each key's name, role, prefix, when it was created, and when it was last used — so you can spot keys nothing uses any more.
• Revoke stops a key working immediately.
• To rotate a key, create a new one, switch your script to it, then revoke the old one.

Good practice

• One key per integration, named for its purpose, so you can revoke precisely.
• Prefer Viewer unless a script genuinely needs to change things.
• Revoke keys for decommissioned scripts and rotate on a schedule.