Skip to main content
An API credential belongs to one account. It can have access to all workspaces or selected workspaces. The dashboard creates a selected-access credential from Workspace settings → API keys. OpenPMM shows the API key secret one time. Send the secret as a bearer token. POST /signup-intents, POST /cli-authorizations, and POST /cli-authorizations/token do not need an API key. They form the short-lived browser handoff that creates a credential before one exists.
The header format is:

​
Key handling

  • Store keys in a server-side secret manager.
  • Never expose a key in browser code, mobile binaries, logs, or URLs.
  • Use separate keys for separate deployments or integrations.
  • Revoke a key when you do not need it.
  • Revoke and replace a key when another person or system can have access to it.
Do not extract a key from the OpenPMM CLI credential store. A direct API integration must use its own least-privilege credential. Let the CLI manage the credential that it creates.
Call GET /account to get the account and credential context. Call GET /workspaces to list the workspaces that the credential can use.