Skip to main content
API keys let scripts, CI, and integrations authenticate to the Zwiron API without a browser session. Each key has a name, a role, an optional expiry, and is shown in plaintext exactly once at creation.
API keys are available on paid plans when the api_keys feature is enabled for your organization. Admins create and revoke keys under Settings → API Keys.

​
Create an API key

  1. Go to Settings → API Keys
  2. Click Create API key
  3. Enter a name, choose a role (admin, editor, or viewer), and optionally set an expiry
  4. Copy the key immediately — Zwiron stores only a hash afterward
Keys are generated with a zk_ prefix (for example zk_a1b2c3…). The UI also shows a short prefix so you can recognize the key later without seeing the full secret.

​
Authenticate requests

Send the key as a Bearer token:
The key’s role scopes what the call can do (same role model as human users). Prefer the least-privileged role that works for the integration.

​
Manage keys

Rotate by creating a new key, updating clients, then deleting the old key.

​
Security

  • Store keys in a secrets manager — never commit them to source control
  • Prefer short-lived keys for contractors and CI jobs
  • Revoke immediately if a key may have leaked
  • Use Agent mode + local credentials for database secrets; API keys authenticate the control plane, not your source databases
Last modified on October 10, 2026