Authentication

Every API request is authenticated with a bearer token. Keys are scoped and rotatable.

Create a key

Create keys in the dashboard or via the CLI:

optamus keys create --name ci --scope runs:write

Scopes

Scope	Grants
runs:read	Fetch and list runs
runs:write	Create and stream runs
workspaces:read	List workspaces
workspaces:write	Create and update workspaces

Rotation

Rotate a key without downtime by creating a second key, deploying it, then revoking the old one:

optamus keys create --name ci-2 --scope runs:write
optamus keys revoke key_old_id

Revocation is immediate. In-flight runs finish; new requests with the revoked key get 401.