Tenant API Keys
Programmatic API access using tenant-scoped API keys.
Overviewโ
Tenant API Keys provide an alternative to JWT authentication for machine-to-machine communication. Each key is scoped to a specific tenant.
Creating API Keysโ
POST /api/tenant-api-key
Authorization: Bearer {admin-token}
Content-Type: application/json
{
"name": "CI/CD Integration",
"expiresAt": "2025-12-31T00:00:00.000Z"
}
Using API Keysโ
Include the API key in the X-API-Key header:
GET /api/employee
X-API-Key: {api-key}
Key Propertiesโ
| Property | Description |
|---|---|
| Name | Human-readable key identifier |
| API Key | The secret key (shown once) |
| Expires At | Optional expiration date |
| Tenant | Scoped to creating tenant |
Security Considerationsโ
| Practice | Recommendation |
|---|---|
| Key storage | Store as environment variable |
| Rotation | Rotate quarterly |
| Expiration | Always set expiration dates |
| Minimum scope | Create purpose-specific keys |
| Revocation | Delete immediately if leaked |
Related Pagesโ
- Tenant Endpoints โ tenant API
- API Security Best Practices โ API security
- Secret Management โ managing secrets