API keys
Issuing and revoking orchestrator-global API keys
client.api_keys mints and revokes API keys. All three methods require the
master token, the server enforces this regardless of what token the client
was constructed with. They also require the orchestrator to be running with
DATABASE_URL set: without a Postgres-backed key store the routes are never
mounted, so these calls raise fuse.ApiError with status == 404 and an
empty code (fuse.is_not_found returns False) rather than a structured
not_found. The stub setup in
Advanced usage is exactly that case.
key = client.api_keys.create("ci-runner")
print("save this now:", key.key) # shown exactly oncelabel is optional. key.key holds the raw secret and is returned exactly
once, it cannot be recovered afterward, store it immediately.
Everything else
| Method | Purpose |
|---|---|
list() |
List key metadata, APIKey has no key field. last_used_at/revoked_at are None until they happen. |
revoke(key_id) |
Revoke the key with the given key_id (the APIKey.id, not the secret itself). |
These mirror the HTTP API one to one.