Security
API Keys
Secure machine access to Infraova — creating keys, authentication, usage, rotation, and protecting credentials.
What API keys are for
API keys give external systems programmatic access to Infraova. If you have an internal dashboard that pulls domain health data, a reporting script that generates weekly summaries, or an automation that monitors issue status, an API key is how that system authenticates with the Infraova API. API keys are for machine-to-machine access — not for human login.
Creating an API key
API keys are created from Settings → Organization → API Keys. When creating a key, give it a descriptive label — the label is the only way to identify the key's purpose later. The full key value is shown once at creation time and cannot be retrieved again. Copy it immediately and store it securely.
Note
If you lose an API key after creation, you cannot recover it. Revoke the key and create a new one.
Using an API key
Include the API key in the Authorization header of every API request using the Bearer scheme. The key is validated on every request — there is no session or token exchange. Keep the key value in your system's environment configuration, not in source code or version control.
Authorization: Bearer your_api_key_here
Key permissions
API keys inherit read access to all organization data — domains, clients, issues, audit records. API keys are read-only by design. They cannot be used to approve proposals, execute remediations, modify settings, or manage team members. All write operations in Infraova require authenticated human operator action through the dashboard.
Rotating a key
Rotate API keys regularly and whenever you suspect a key may have been compromised. To rotate a key, create a new key with the same label, update your systems to use the new key, and then revoke the old key. Revoking a key immediately invalidates it — any system still using the old key will receive 401 Unauthorized responses.
Multiple keys
Create a separate API key for each system or integration that accesses Infraova. Using separate keys means you can revoke access for one system without affecting others — and the audit trail shows which key was used for each request, making it easier to trace activity back to its source.
Protecting your keys
Treat API keys like passwords. Store them in environment variables or a secrets manager, never in source code. Do not log API keys. Do not share keys between team members — keys are for systems, not people. Revoke any key you believe has been exposed. Monitor the audit trail for unexpected API activity.