API Keys

Create, list, and revoke StateSet Cloud API keys — from the dashboard or the CLI.

An API key authenticates REST calls to the StateSet API, whether from the stateset-node SDK, another client library, the CLI, or your own service.

From the CLI

# List existing keys
stateset cloud api-keys list

# Create one, named for where it will be used
stateset cloud api-keys create --name "ci-bot"

# Revoke by id
stateset cloud api-keys revoke 12

A newly created key is shown once. Store it in a secret manager immediately — it cannot be retrieved afterwards, only revoked and replaced.

From the dashboard

1. Open the Keys tab.
2. Click Create API Key.
3. Enter a name.
4. Click Add Key, then copy the value.

Using a key

Store the key with the CLI so subsequent commands pick it up:

stateset cloud login --api-key $STATESET_API_KEY
stateset cloud whoami          # confirm which identity the key resolves to

Or send it directly:

curl https://api.stateset.com/v1/projects \
  -H "Authorization: Bearer $STATESET_API_KEY"

Naming keys for what they do

Name each key after the system that holds it — ci-bot, sync-worker, laptop-dom. When you need to revoke one, the name is what tells you what breaks.

Issue a separate key per consumer rather than sharing one. Revoking a shared key takes down everything that used it; revoking a scoped key takes down one thing you already identified.

Rotation

There is no in-place rotation. To rotate:

1. Create the replacement key.
2. Deploy it wherever the old key is used.
3. Confirm traffic has moved — stateset cloud whoami from the consumer, or check logs.
4. Revoke the old key.

Doing it in that order means no window where neither key works.

Related

• Authentication — tokens and the auth model
• Cloud Overview