API keys and scopes

An API key gives a script or service access to your workspace without a person signing in. Keys carry scopes, so a key can be limited to what its job needs.

Create a key

Sign in as an admin and open API Keys.
Name the key, choose its scopes and, if you want, an expiry in days.
Copy the key when it is shown. It starts with xcrt_ and cannot be shown again.

Only a signed-in admin can create or revoke a key, and a key can only be given scopes that its creator holds. A new key gets certs:read unless you choose others.

Use a key

curl -H "Authorization: Bearer xcrt_your_key" \
     https://api.automate-certificates.com/v1/certificates

Scopes

Scope	Allows
`certs:read`	List and read certificates and their challenges.
`certs:write`	Request, renew, import, revoke and delete certificates.
`targets:read`	List and read targets.
`targets:write`	Create, change and delete targets.
`deploy:read`	Read deployments.
`deploy:execute`	Run deployments and manage deployment rules.
`monitoring:read`	Read monitoring results.
`alerts:read`	Read alerts.
`alerts:write`	Set alert rules and manage webhooks.
`audit:read`	Read the audit log.

What a scoped key cannot do

Managing members, roles, API keys, ACME accounts and cloud credentials needs a signed-in admin or a full-access key. A scoped key is refused with 403 insufficient_scope, even when its owner is an admin. A few admin actions, such as running a discovery scan or a bulk renewal, accept a key that holds the matching scope and belongs to an admin.

Limits

Each plan allows a fixed number of keys. Requests are limited to 120 per minute for a workspace.