API keys
Organization API keys are account-level credentials, created and revoked in the Cmdop account console. They authorize programmatic access to your account — not to your machines. A machine joins a relay with the fleet join key, and reaching a machine takes the relay’s own credentials, so an API key alone opens nothing on any computer.
Create and revoke API keys for your organization in the account console .
Copy a new key into an approved secret store as soon as it is shown. Keep keys out of source control, examples, and shared chat, and revoke any key you no longer need or believe may have been exposed.
This is not a machine credential
An organization API key is an account-level credential. It is not how a machine joins a relay, and it is not how you reach a machine.
| To do this | Use |
|---|---|
| Join a machine to a relay | The fleet join key — Self-hosted relay |
| Sign in to a relay’s web console | The relay admin password, or a one-time sign-in link |
| Attach to a machine remotely | The relay’s door, plus that machine’s connection PIN when one is armed |
| Build against Cmdop from a program | The SDK and its own credential guidance |
These are separate credential planes. Rotating one does not rotate another — which is what you want during an incident, and what surprises people who assume one key controls everything.
Related
Common questions
What are Cmdop organization API keys for?
Organization API keys authorize account-level programmatic access. They do not join machines to relays, sign you into a relay web console, or attach to a machine.
Is an API key a machine credential?
No. Machine access uses separate relay and machine credentials: fleet join key, relay admin password or sign-in link, and connection PIN when one is armed.
What should I do if an API key leaks?
Revoke it in the account console and rotate any dependent automation through your approved secret-management process. Rotating an organization API key does not rotate relay or machine credentials.
Cmdop