Generate and copy the key
- Open Settings → API keys. Give the key a recognizable name, such as the host or environment that will use it, and select Generate. Make one key per host: a key belongs to the first host that logs in with it, and the keys table shows which host that is.
- Copy the key. Store it in an approved secret manager and keep it out of source control, shell history, screenshots, logs, and support requests. dbtempo keeps an encrypted copy, so anyone signed in to your account can copy a live key again from the keys table.
- Authenticate the CLI. Run the login command on the intended host, then verify the installation.
Install the key in the CLI
dbtempo login
dbtempo doctorPaste the copied key at the login prompt; it is not shown as you type. In a script, use DBTEMPO_API_KEY=... dbtempo login instead. Login stores and verifies the CLI key for that installation. Doctor checks the saved configuration, dbtempo access, database connectivity, collection sources, and credit availability.
If login says the key belongs to another host, that key is already in use elsewhere. Create a new key for this host and run dbtempo login again.
Rotate or revoke a key
- Generate the replacement first. Install it on every CLI host that uses the old key and run
dbtempo doctoron each host. - Confirm the replacement is active. The API keys table reports each key's prefix and last-used time.
- Revoke the old key. Revocation takes effect immediately. Any CLI installation still using that key stops authenticating until it receives a valid replacement.