API keys
Create scoped, hashed API keys for scripts, CI, and the Flight SQL query path.
API keys are the credential for headless access - CI pipelines, scripts, and
eddytor query. They're scoped, hashed at rest, and shown only once.
Format & storage
edd_live_<40 hex characters>Keys are hashed (HMAC-SHA256) before storage - the plaintext is shown once
at creation. No GET endpoint ever returns a key. The edd_live_ prefix makes
keys easy to spot (and to flag) in logs and config.
Two ways to mint a key
The admin bootstrap key - full admin, non-expiring, minted via the same exec
boundary as eddytoradm setup:
docker compose exec eddytor-server eddytoradm create-api-key --email you@example.com
# Admin API key for you@example.com (shown once): edd_live_…Use it for the CLI and for eddytor query (it doesn't expire, unlike a login
token):
eddytor config set-key edd_live_…Create a scoped key for day-to-day automation:
eddytor create api-key "CI Pipeline" --scopes tables:query,rows:insert--scopes is a comma-separated list. List and revoke keys:
eddytor get api-keys
eddytor delete api-key <id>POST /v1/api-keys
Authorization: Bearer edd_live_…
{ "name": "CI Pipeline", "scopes": ["read"] }Pass a preset (read / write / admin) or explicit scope tokens in the
scopes list - presets are expanded server-side.
Scopes restrict, never expand
A key's scopes can only narrow what the creating user can already do - a key can never exceed its creator's role. Three presets cover common cases:
| Preset | Allows |
|---|---|
read | Query tables, view metadata, list resources |
write | read + insert/update/delete rows, manage domains |
admin | Everything the creating user can do |
For fine-grained control, scopes group into categories - Tables, Rows, Domains, Connections, Storage, AI, API Keys, Organisation. The full token list is in the API keys reference.
Keys bind to an organisation and workspace
A key is frozen to the organisation and workspace of the session that mints it - it only ever reaches that workspace, and archiving the workspace revokes it. Switch to the right workspace before minting; see Switching, tokens & API keys.
Revocation
Revoke a key and it's invalidated immediately - subsequent requests get 401 Unauthorized. No waiting.