API tokens

API tokens authenticate machines: CI pipelines uploading test reports, and anything else calling the ingestion API.

Administration → API Tokens. Owners and admins only.

Creating one

Give it a name that says which machine or pipeline will hold it, and optionally an expiry. The token is displayed once. Copy it immediately.

Each token carries the organization it was made in — that is what scopes every request made with it, and why the CLI needs no organization argument.

Using one

Send it as the x-api-token header, or set SEKEE_API_TOKEN and let sekee-cli do it.

export SEKEE_API_TOKEN="…"

In CI, store it as a secret. A token in a committed pipeline file is a token that has to be rotated.

What a token can do

CI tokens are for ingestion only: creating automation runs, appending threads to them, and completing them. They are not a general-purpose API key and cannot read your test library or write to it.

:::info Not the same thing as an AI connector token AI connector tokens are a different kind of credential in the same table: they belong to a user, act as that user, and are managed by that user under Settings → AI Connector. A token with no user is a CI token, and none of the connector's scoping applies to it. :::

Rotating and revoking

Revoking is immediate. Rotate by creating the new token, updating the secret in your pipeline, confirming a run lands, then revoking the old one — in that order, so there is never a window where CI cannot report.

The list shows each token's prefix, when it was created, when it expires, and when it was last used. A token that has never been used is either a rotation somebody forgot to finish or a leak worth thinking about.