API Keys Management
Create, store, and revoke API credentials for secure server-to-server integration with CYRIS.
How API Keys Work
CYRIS API keys allow external automated scripts, CI/CD pipelines, and internal tools to authenticate requests to the CYRIS customer API. Keys are managed under Settings > Developer > API Keys.
API keys are scoped to read-only account information (customer:account:read) for the security-certified endpoint GET /api/v1/customer/account.
Key Lifecycle & Security
User-Owned Credentials
Each API key belongs directly to your user account and operates under the certified customer:account:read scope.
One-Time Secret Reveal
For security, the full plaintext API key is displayed exactly once upon creation. CYRIS never stores or displays plaintext keys again.
Display Renaming
You can rename an API key anytime to clarify where it is used. Renaming updates only the reference label without altering credentials.
Immediate Revocation
Revoking an API key immediately invalidates the credential across all external services. Revocation cannot be undone.
Treat API keys like passwords. Never commit keys to public git repositories or expose them in client-side code. If you suspect a key has been compromised, revoke it immediately and create a new key.
Revoking a Key
To revoke a key, navigate to Settings > Developer > API Keys, locate the key, and click the trash icon. Confirming revocation terminates authorization immediately across all requests using that key.