API keys
Organization-scoped bearer tokens. The plaintext value is shown once. Scopes are enforced on every request.
Purpose
An API key authenticates a client to /api/v1 for one organization. It is not a login cookie and not a CA credential.
Prerequisites
A registered account and an organization. Owners and admins can create keys in the dashboard or POST /api/v1/api-keys.
Steps
Create a key with a name and abilities such as certificates:write. Copy the token immediately. Send Authorization: Bearer and optional X-Organization-Id. Rotate by creating a new key, switching clients, then deleting the old key.
Expected states
A live key records last_used_at. A deleted key returns 401. Missing abilities return 403 insufficient_scope.
Errors
insufficient_scope, unauthorized, organization_not_found. Tokens are hashed at rest; we cannot recover a lost plaintext value.
Security
Store keys in a secret manager. Do not commit them. Prefer one key per application so revocation is narrow.
Related
Docs /docs/authentication. Product /ssl-certificate-api. Academy /academy/what-is-acme.