API Keys

API keys let the CLI, CI pipelines, and coding agents act in your organization without a browser. Manage them under Settings › API Keys.

Kinds of Keys

Kind	Who creates it	Acts as	Use it for
Personal key	Anyone	You, with at most your role	Scanning from your computer or a container, and serving coding agents.
Organization key	Admins	No user; belongs to the organization	Continuous integration and other shared automation.

protomap login creates a personal key for you, which can only upload scans and read the graph. See Authentication.

An organization key outlives the people who set it up, but it has no private scans: only scans that can join the shared graph count, and it cannot serve a coding agent.

Create a Key

1. Go to Settings › API Keys and create a key.
2. Name it after where it will be used, such as GitHub Actions.
3. Admins choose its role: Admin, Write, or Read. Other users’ keys get Write, or Read for users with the Read role.
4. Copy the key. It is shown only once.

Use it as PROTOMAP_API_KEY, with PROTOMAP_URL set to your server’s address.

Revoke a Key

Keys do not expire. Revoke a key you no longer need, or one that may have leaked, with Revoke: anything using it stops working. Last used shows when each key was last used.

Admins see and can revoke every key in the organization; everyone else sees their own. Removing a user from the organization also stops their personal keys.