Documentation
How-to guides

Create and rotate a CLI API key

Generate a one-time CLI credential, install it, and revoke old keys safely.

4 min read

Generate and copy the key

  1. Open Settings → API Keys. Select Generate key and give the installation a recognizable name, such as the host or environment that will use it.
  2. Copy the full secret now. The complete key is shown only once. Store it in an approved secret manager and keep it out of source control, shell history, screenshots, logs, and support requests.
  3. Authenticate the CLI. Run the login command on the intended host, then verify the installation.

Install the key in the CLI

dbtempo login --api-key <copied-key>
dbtempo doctor

Login stores and verifies the CLI key for that installation. Doctor checks the saved configuration, dbtempo access, database connectivity, collection sources, and credit availability.

Rotate or revoke a key

  1. Generate the replacement first. Install it on every CLI host that uses the old key and run dbtempo doctor on each host.
  2. Confirm the replacement is active. The API Keys table reports each key's prefix and last-used time without revealing the stored secret.
  3. Revoke the old key. Revocation takes effect immediately. Any CLI installation still using that key stops authenticating until it receives a valid replacement.