Keys & permissions
Connect securely to one workspace using a bearer API key.
Send the key with every request
Authorization: Bearer YOUR_API_KEYThe key belongs to one workspace and its issuing owner or admin. The issuer must remain an active owner/admin in an active workspace. Expiry, revocation, account suspension or losing that role stops access. A website login cookie is not required for supported API calls.
Manage access in the app
Only workspace owners and admins can create, list, reveal, copy or revoke keys and see workspace API usage. Key creation requires a current signed-in session. Use the key table to show or copy a secret later. Advanced settings lets you restrict permissions or choose an expiry. Revoke permanently removes the key; create a new one when you need a replacement.
| Permission | Allows |
|---|---|
| workspace:read | Read context and workspace |
| reports:read | List/read reports and scan runs |
| profiles:read | List report profiles |
| reports:create | Create reports together with reports:read; initial profiles also require profiles:add |
| profiles:add | Validate, add and restore profiles |
| imports:read | Retrieve saved import receipts |
Keep secrets on the server
Use your automation tool’s credential store or server-side environment variables. Do not embed keys in browser JavaScript, URLs, analytics or screenshots. Test and live keys are environment-specific. If a key is exposed, revoke it and update the integration with a newly created key.