API Keys

API keys allow programmatic access to Warden’s API. Only admins can create and manage API keys.

Creating an API Key

1. Navigate to Settings → API Keys
2. Click Create API Key
3. Enter a name to identify the key (e.g., “CI/CD Pipeline” or “Terraform”)
4. Select a role for the key — this determines what the key can access (defaults to Editor)
5. Click Create

Caution

The full API key is only shown once. Copy it immediately and store it securely — you will not be able to see it again.

API keys use the format sk_live_ followed by a 64-character hex string.

Using an API Key

Include the key in the Authorization header of your HTTP requests:

curl -H "Authorization: Bearer sk_live_your_key_here" \
  https://your-warden-instance.com/api/monitors

The key’s role determines which endpoints it can access. See Roles & Permissions for the full permission matrix.

API Key Roles

API keys follow the same RBAC system as users:

Role	Access Level
Admin	Full API access including user management and settings
Editor	Can create/modify monitors, incidents, maintenance, and notifications
Viewer	Read-only access to monitors, incidents, and reports
Status Viewer	Can only access assigned status pages via API

Note

API keys cannot access the /api/auth/me endpoint. They are identified separately from user sessions to prevent authorization confusion.

Viewing API Keys

The API Keys page shows:

• Key name
• Key prefix (first 12 characters, e.g., sk_live_abcd)
• Assigned role
• Date created
• Last used timestamp

Revoking an API Key

1. Navigate to Settings → API Keys
2. Find the key and click Delete

The key is immediately invalidated. Any requests using it will receive a 401 Unauthorized response.

Security

• API keys are hashed with bcrypt before storage — the raw key is never stored
• Only the key prefix is stored in plaintext for identification purposes
• The last_used_at timestamp is updated on each use so you can identify stale keys