Console
API keys
Create, scope, rotate, and revoke programmatic credentials.
API keys authenticate programmatic callers — scripts, integrations, and AI agents — against the platform under your identity, limited to the scopes you grant.
Creating a key
- Open Settings → API keys and choose Create key.
- Select the scopes the key needs — read, write, render, share, publish, and delete are distinct permissions; grant the minimum.
- Optionally restrict the key to particular artifacts.
- Copy the revealed key once — it is never shown again.
Using a key
Send the key as a bearer credential in the Authorization header of your
requests:
curl -H "Authorization: Bearer <your-key>" \
https://api.xentropy.ai/api/v1/artifactsStore keys in your secret manager or environment configuration — never in source code, project files, command-line arguments, or URLs.
Rotation and revocation
- Rotate replaces a key with a new credential in one step; use it as part of routine key hygiene or after any suspected exposure.
- Revoke disables the key immediately; the next request with a revoked key fails authorization.
Key-hygiene rules
Least privilege
A key can only do what its scopes allow, on the artifacts it is restricted to (if any). An agent cannot mint another agent credential, and ownership checks always apply on top of scopes.
- One key per integration, named for it.
- Prefer artifact-restricted keys for agents that work on specific artifacts.
- Rotate on a schedule; revoke immediately when an integration is retired.
See agents → API keys and scopes for the agent-facing view of the same model.