Skip to main content

Management API Keys

Management keys call the WardenAuth API. Use them in your backend to check access, create scopes, manage roles — anything that requires the management API.

How it works​

A management key is a long-lived credential your backend uses to call the management API. Assign roles to control what the key can do.

Creating a key​

cURL

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/api-key/management \
  -H "x-api-key: YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Backend Access Checker",
    "roles": ["access-checker"],
    "autoRotationEnabled": true,
    "autoRotationIntervalDays": 30,
    "autoRotationOverlapDays": 7
  }'
{
  "keyId": "key_a1b2c3d4",
  "rawKey": "sk_live_eJx1VUd...",
  "maskedKey": "sk_live_****Ud...",
  "name": "Backend Access Checker"
}

Store rawKey immediately. It's shown only once.

Prerequisites​

  • You need api-key.management:create permission.
  • Management keys require at least one role. Without roles, the key can authenticate but can't call any endpoint.
  • Assign access-checker for runtime access checks. Assign platform-admin only for full system administration.

Edge cases​

  • The raw key is shown once. After creation, only the masked version is retrievable. Rotate the key if you lose it.
  • Management keys can delete themselves. If you delete the key you're using, you're locked out. Keep a backup admin key.
  • Key rotation preserves scope. Rotating a management key gives you a new key in the same scope with the same roles.

In the dashboard​

[Screenshot: Management Keys tab showing key list with masked values and auto-rotation toggles]

Navigate to Management Keys. Click New Management Key, name it, and assign roles. The raw key appears once — copy it immediately.