API keys

Use dashboard to manage operator API credentials safely.

Recommended key split

• launch key: launch:write
• reporting key: read scopes only
• webhook admin key: webhooks:read, webhooks:write
• staging simulator key: simulator:read, simulator:write

Avoid one all-purpose key unless operationally necessary.

Create flow

1. choose clear key name by workload
2. assign minimum scopes
3. store token in secret manager immediately
4. test one expected endpoint

See scope list at /docs/reference/scopes.

Rotation flow

1. create replacement key first
2. deploy replacement secret to operator systems
3. verify new key works
4. revoke old key

Do not revoke old key before replacement is live.

Revocation guidance

Revoke immediately if:

• token leaked to logs or chat
• token committed to repo
• token shared outside approved operators
• unknown traffic appears

Troubleshooting

• INVALID_API_KEY -> token wrong, revoked, or sent to wrong environment
• INSUFFICIENT_SCOPE -> wrong scope set
• INVALID_SCOPES during creation -> unsupported scope name

Related pages

• API contract: /docs/operator-api/api-keys
• current session introspection: /docs/operator-api/session