API keys
API keys provide user-level access to the servasec API. Unlike application tokens (which are scoped to a single application), API keys carry the permissions of the user who created them.
Keys are prefixed with sc_ to distinguish them from application tokens. The full key is only shown once at creation.
Create an API key
Send a name for the key. The response includes the full key value.
Use an API key
Pass the key in the X-Api-Key header when making API requests.
Revoke an API key
Revoking a key immediately invalidates it. Any requests using a revoked key are rejected.
Key comparison
| Feature | Application token | API key |
|---|---|---|
| Prefix | - | sc_ |
| Scope | Single application | User-level (all permitted resources) |
| Header | X-Api-Token | X-Api-Key |
| Use case | CI/CD ingest | Scripting, automation, custom integrations |