Skip to main content
API keys are project-scoped credentials for backend services, CI, and automation that call MeshAgent APIs. Use them when a service or script needs to act on behalf of the project. Do not put them in end-user clients or use them as the user’s sign-in credential. People using MeshAgent Studio or Powerboards sign in with MeshAgent directly. If you are building your own app on top of MeshAgent, use the API key on your backend, create an OAuth client for user sign-in when needed, and issue participant tokens to the client.

​
Create a key

You can create API keys in MeshAgent Studio or with the CLI. The secret value is only shown once.

​
MeshAgent Studio

  1. Open your project in MeshAgent Studio.
  2. Go to Access Management.
  3. Open a service account’s API Keys menu.
  4. Create a new key and save the secret value.

​
MeshAgent CLI

If you want to create a key from the terminal and activate it for local CLI use at the same time:
--activate saves the new key in your local CLI project settings so commands that use an API key can pick it up automatically. To activate an existing key later, use:

​
Permissions to create keys

The caller must have both api_key_creator and api_key_manager on the project. Service accounts do not have these roles by default, so a default service account cannot create API keys, including keys for itself. OAuth credentials must also include the developer scope. A project administrator can assign the roles with the CLI. For example, to give a service account member, developer, and both API-key roles:
iam grant replaces the subject’s direct roles on that resource. Include any other existing direct roles you want to retain in the same command. These permissions apply to the whole project. A service account with both roles can create an API key for any other service account in that project and use that key to act as the target account. Grant these roles only to callers trusted with that authority.

​
Rotate or remove keys

List the keys for a service account in the active project:
Print the locally activated key id, or emit it as a shell export snippet:
Delete a key you no longer need:

​
Best practices

  • Rotate regularly and delete unused keys.
  • Store keys securely in a secret manager or CI vault.
  • Avoid sharing keys across multiple services.