API keys

One key model for every product that takes keys: created under your organization, scoped to one product, sent as a bearer token.

Create a key

Open platform.ciresk.com and go to API tokens for a token that acts for the organization, or My profile › API tokens for one that acts as you.
Select Create token, then a template or Create custom token.
Name it, add a permission policy with the permissions it needs (for Ciresk CI, see Scopes) and an expiry of at most 90 days, then select Review token and Create token.
Copy the token. It is shown once; the platform keeps only a fingerprint.

A key starts with csk_live_ followed by the organization's region (csk_live_eu_...), so a key names its region without any extra configuration. Send it on every request as Authorization: Bearer <key>; the ciresk ci CLI reads it from CIRESK_TOKEN.

Shell

export CIRESK_TOKEN=csk_live_eu_...

Kinds of credential

Credential	For	Lifetime
API key (`csk_live_<region>_`)	Scripts, servers, agent sandboxes	Until revoked or its expiry; a revocation is effective within 60 s
Exchanged token (`cix_`)	GitHub Actions jobs, which trade their OIDC token through Ciresk CI's exchange endpoint	1 hour
Person token	What a CLI keeps in the OS keychain and MCP clients obtain through OAuth; not for scripts	Refreshed in the keychain

Every credential belongs to one organization. A credential acts within the region its organization is pinned to; Ciresk CI refuses it elsewhere before any query. See Regions.

Through the API

Everything the page does, a script can do with the Platform API at https://api.ciresk.com: GET /v1/platform/keys lists the organization's keys, POST /v1/platform/keys mints one (the plaintext is returned once), POST /v1/platform/keys/{key_id}/rotate replaces one and keeps the old one working for a grace period (24 hours by default), POST /v1/platform/keys/{key_id}/revoke revokes one, and GET /v1/platform/keys/whoami says who a credential is.

Rotate and revoke

Rotate or revoke a key on the same page. Rotating gives you a new key and keeps the old one working beside it for 24 hours; revoking stops it within 60 s on every product that takes keys. Exchanged tokens expire with the hour and cannot be revoked separately.

Good to know

A product does not store keys or their hashes: it introspects a key by fingerprint at the platform and caches the answer for 60 s.
A key acts as the person who created it and cannot be created with more than their role allows; when that person leaves the organization, the key stops working within 60 s.
The API conventions (idempotency, pagination, errors, request ids) are on the API overview.