Skip to main content

​
Manage API keys

​
What does this do for me?

You create an API key to let a script or external service interact with KeylessSSL without signing in through the browser. Each key carries only the scopes you choose.

​
Before you begin

You need an owner, admin, or operator role. Read-only members cannot create or change API keys.

​
Create a key

  1. Open API Keys.
  2. Select Create key.
  3. Enter a label to identify the key later.
  4. Select one or more scopes for the key:
    • domains:read — list and view domains.
    • domains:write — add, update, and remove domains.
    • certs:read — list and view certificates.
    • certs:issue — request certificate issuance and sync provider state.
    • webhooks:write — register, update, and delete webhook endpoints.
    • audit:read — search the organization audit log.
  5. Select Create.
The portal shows the new key secret exactly once. Copy it and store it in a secure location, such as a secrets manager or environment variable.

​
Use the key

Send the key in the Authorization: Bearer header when calling the API:
The key is tied to your organization and cannot be used to access another organization’s resources.

​
Rotate a key

  1. Open API Keys.
  2. Select Rotate next to the key.
  3. The portal shows a new secret. Copy it and update anything that used the old secret.
Rotation replaces the key value immediately. The previous secret stops working.

​
Revoke a key

  1. Open API Keys.
  2. Select Revoke next to the key.
Revocation is permanent. You cannot restore a revoked key.