Docs / User Management

API keys

Create API keys under dashboard Settings for automation. Authenticate with Authorization: Bearer <token>. See Authentication for session cookies and OAuth.

Per-key role

Each key has a role (built-in or custom IAM role). The key inherits that role's permissions — the same checks used for session users. Creating or revoking keys requires apikeys.manage (admins by default).

Create a key

http
POST /v1/api-keys
Authorization: Bearer $ISOWARD_API_TOKEN
Content-Type: application/json

{ "name": "ci", "role": "developer" }

GET /v1/api-keys returns id, name, role, and created_at. The secret is shown only once at creation — copy it immediately.

Static operator token

ISOWARD_API_TOKEN (legacy BREACHFIX_CLOUD_API_TOKEN) is a break-glass Bearer for the seeded default admin on wks-default. It still goes through RBAC — it does not bypass permission checks. Prefer workspace API keys for day-to-day automation.