API Keys

An API key is a headless login for the EnvManager CLI. It lets a machine sign in as you without opening a browser, which is exactly what you need for CI jobs, build steps, and servers.

A key does not have its own permissions. It carries your access and never more: the same organizations, the same projects, the same environments you can reach when you sign in yourself. If you cannot see a variable, neither can your key.

Keys only work through the CLI. There is no separate API to call with them.

Use an API key when:

• A GitHub Actions, GitLab CI, or other pipeline needs to pull variables during a build
• A server or container starts up and needs its configuration
• A script runs on a schedule with nobody there to log in

For everyday work on your own laptop you do not need a key. Run envmanager login instead and sign in through your browser.

Before You Begin

• You need an EnvManager account and membership of at least one organization. API keys are available to every member on every plan, and there is no limit on how many you can have.
• Install the CLI if you have not already. See CLI Overview.
• Have somewhere safe to store the key, such as your CI platform's secrets or a password manager. The key is shown only once.

Finding Your API Keys

The API Keys tab lists the keys you created and, below them, the machines where you signed in with the CLI.

The API Keys card lists every key you created:

Creating an API Key

The Create API key dialog. The Organization field only appears when you belong to more than one organization.

Saving the Key

Once the key is created, a dialog shows the full key.

This is the only time the full key is shown. Copy it before you close the dialog.

Using the Key

On any machine, set the key as an environment variable and run the CLI as usual:

export ENVMANAGER_API_KEY=em_your_api_key_here
envmanager pull

In a pipeline, never paste the key into a file you commit. Store it as a secret in your CI platform and hand it to the job as an environment variable:

GitHub Actions:

env:
  ENVMANAGER_API_KEY: ${{ secrets.ENVMANAGER_API_KEY }}

GitLab CI: add ENVMANAGER_API_KEY as a masked CI/CD variable in your project settings.

See CLI Authentication for the full setup and more examples.

Revoking a Key

Revoke a key when the pipeline that used it is gone, when someone who should not have it may have seen it, or when you have replaced it with a new one.

There is no "regenerate" button. To rotate a key, create a new one, put it in your CI secrets, check that the next run succeeds, and then revoke the old key.

Signed-in CLI Devices

Every time you run envmanager login on a machine, that machine gets its own sign-in. Those sign-ins appear in the Signed-in CLI devices card, separate from the keys you created by hand, so your key list stays readable.

Each row shows Signed in with the date, the first characters of the sign-in, when it was last used, and when it expires (90 days after you signed in).

To log a machine out, click Sign out on its row and confirm in the "Sign out this device?" dialog. That machine will need to run envmanager login again.

For Owners and Admins

If you are an owner or admin, you also get a view of every key in your organization. On the API Keys tab you will see an info box linking to Organization settings.

Go to Settings > Organization and find the API Keys & CLI Logins card.

Owners and admins see every active key and CLI login in the organization, with a Revoke button on each row.

The card lists every active key and CLI sign-in in the organization:

Click Revoke on any row and confirm to switch that key off immediately.

Members do not see this card and cannot revoke anyone else's keys. They manage only their own, on the API Keys tab.

Use this view to check that keys are not piling up, that old pipelines are not still holding a key, and that people who left have no keys standing.

Security Notes

A key is as powerful as you are. It inherits your access and never more. If you are an owner, a key you create can reach everything an owner can. Keep that in mind before you paste one into a pipeline that other people can edit.

A key is shown once. We never email a key, and we cannot show it again. If you lose it, revoke it and create a new one.

You are told when a key is created. Every time a key is created on your account you receive an email: "New API key on your EnvManager account", with the key's name. If it was not you, revoke that key straight away and change your password. CLI sign-ins do not send an email.

Everything is recorded. Creating and revoking a key is written to your account's security history, alongside sign-ins and password changes.

Leaving an organization removes access. When someone is removed from an organization, their keys for it stop working.

Keys only work through the CLI. A key cannot be used to sign in to the dashboard and there is no separate API that accepts it.

Tips & Best Practices

• One key per pipeline — Name it after the job that uses it. When that job goes away, you know exactly which key to revoke.
• Keep the default 90 days — Rotating a few times a year is a small chore that keeps a forgotten key from living forever.
• Only pick "Never" deliberately — For a long-running server where rotation is genuinely painful, and write down where the key lives.
• Never commit a key — Always use your CI platform's secrets. A key in a repository is a key that has leaked.
• Rotate before you revoke — Create the new key, update the secret, confirm a successful run, then revoke the old one.
• Check the list now and then — A key with a "Last used" from months ago is usually a key nobody needs.

Related Topics