API Keys

Manage API keys from the CLI.

kernel api-keys create

Create an API key. By default, the new key is org-wide. Pass --project-id to create a key whose own access is scoped to that project.

kernel api-keys create \
  --name staging-ci \
  --days-to-expire 30 \
  --project-id proj_staging_9f3k \
  --output json

Flag	Description
--name <name>	API key name. Required.
--days-to-expire <days>	Number of days until expiry, from 1 to 3650. Omit for no expiry.
--project-id <project_id>	Create a project-scoped API key for this project. Omit for org-wide.
--output json, -o json	Output the raw JSON object, including the plaintext key on create.

--project-id controls the access scope of the new API key. The global --project flag only scopes the CLI request you’re making.

kernel api-keys list

List API keys in the authenticated organization. API keys are masked.

kernel api-keys list --limit 20

Flag	Description
--limit <n>	Maximum number of results to return.
--offset <n>	Number of results to skip.
--output json, -o json	Output the raw JSON array.

kernel api-keys get <id>

Show one API key by ID. The response includes the masked key and metadata, not the plaintext key.

kernel api-keys get key_01jwv4tn5m8k3q2v7x9p0a1bc2

Flag	Description
--include-deleted	Include soft-deleted API keys in the lookup.
--output json, -o json	Output the raw JSON object.

kernel api-keys update <id>

Rename an API key.

kernel api-keys update key_01jwv4tn5m8k3q2v7x9p0a1bc2 --name staging-ci-rotated

Flag	Description
--name <name>	New API key name. Required.
--output json, -o json	Output the raw JSON object.

kernel api-keys rotate <id>

Issue a replacement API key. The rotated key keeps working for a grace period so you can migrate callers without downtime.

kernel api-keys rotate key_01jwv4tn5m8k3q2v7x9p0a1bc2 \
  --days-to-expire 90 \
  --expire-in-days 7 \
  --yes \
  --output json

Flag	Description
--days-to-expire <days>	Lifetime of the new key, from 1 to 3650 days. Omit to reuse the rotated key’s lifetime.
--expire-in-days <days>	Grace period before the rotated key expires. Pass 0 to expire it immediately; omit for the default of 7 days.
--yes, -y	Skip the confirmation prompt.
--output json, -o json	Output the raw JSON object, including the new one-time plaintext key.

Save the new plaintext key when you rotate it. Kernel won’t return it again.

kernel api-keys delete <id>

Delete an API key.

kernel api-keys delete key_01jwv4tn5m8k3q2v7x9p0a1bc2 --yes

Flag	Description
--yes, -y	Skip the confirmation prompt.

Aliases

You can also use kernel api-key, kernel apikeys, or kernel apikey.