Security & Access · API keys

API keys

Create, name, scope, and revoke account credentials from the console.

An API key is a named credential tied to your account, created and managed from Account → API Keys.

Why keys exist at all

You do most things on NevTan by clicking through the console while signed in — there's no separate credential involved. A key matters for the handful of cases where something other than you sitting at the dashboard needs to be identified and later distinguished from everything else on the account: a CI pipeline, a teammate's script, a third-party integration you've wired up, or simply "the credential I made for that one project six months ago." Naming and scoping keys is what lets you answer, months later, exactly which integration a given credential belongs to and whether it's still needed.

API keys, 2FA, or SSH keys?

NevTan has three separate security primitives, each protecting a different surface. Reach for the one that matches what you're trying to protect:

Primitive	Protects	Use it for
API key	A named account credential	Naming and revoking a credential from Account → API Keys
Two-factor auth	Your account login itself	Stopping sign-in with a stolen password — see Two-factor authentication
SSH key	Direct shell access to a running instance	Connecting to a GPU instance — see SSH keys

For everything else on the platform — creating projects, checking billing, managing team members — you're already signed in to the console; there's no separate credential to manage. See Account & security for how sign-in itself works.

Create a key

1
Open Account → API Keys
Click Create key to open the form.
2
Name it, and scope it if you want
Give it a descriptive name and, optionally, scope it to a single project — an unscoped key applies across your whole account.
3
Copy it now
The console shows the full key once, right after creation. Copy it somewhere safe before closing the dialog.

Parameter	Type	Description
`name`required	string	Human-readable label shown in the key list.
`project`	string	Scope the key to one project. Leave unset for an account-wide key.

Rotate and revoke

Rotate before you have to. There's no in-place "reissue" for a key in the console — rotation means creating a new key, letting whatever depends on the old one pick up the new one, and then revoking the old key once you've confirmed the new one is working.
Scope tightly. Give each project its own scoped key instead of relying on one account-wide key everywhere. A leak then only affects one project, not your whole account.
Name keys for what they do. A clear, specific name makes it obvious which key to rotate or revoke when something is retired or a credential leaks.
Revoke immediately on suspicion. Revoking from the key list takes effect immediately — there's no grace period, so confirm a replacement is in place first if this is a planned rotation.

What a compromised key actually means

A leaked key is only as dangerous as its scope. An unscoped, account-wide key that leaks is effectively the same risk as a leaked password for whatever it can touch — anything wired to trust "a valid key on this account" will accept it until you revoke it. A key scoped to a single project limits that same leak to just that project. This is the practical reason scoping matters: it turns "I have to worry about my whole account" into "I have to worry about one project," and it's decided once, at creation time, not after the fact.

Notice or suspect a leak

unexpected use, exposed in a log, shared by mistake

Revoke the key

Account → API Keys, immediate

Create a replacement

new name, same or tighter scope

Check Activity

confirm what the old key was used for

Important

The full key value is shown only once, at creation, and never again afterward. Revoking a key from Account → API Keys takes effect immediately.

Note

After revoking a suspected leak, check Audit logs for the affected key to see what it was used for while it was live — that's often the fastest way to judge whether anything downstream needs attention.