Manage API keys

Use API keys to engage with Endor Labs services programmatically and enable any automation or integration with other systems in your environment. You can manage API keys with endorctl or from the Endor Labs user interface.

API keys are region-bound. If you’re using a EU tenant, create your API keys from within your EU tenant at https://app.eu.endorlabs.com.

Instead of using API keys, you can use keyless authentication to authenticate with Endor Labs services. See Keyless authentication for more information. Using keyless authentication eliminates the need to manage API keys and reduces the risk of API key compromise.

See API key management best practices for more information on how to manage API keys.

Create an API key

Create an API key to access Endor Labs services programmatically. You can create an API key either from the user interface or using the Endor Labs API. You can create API keys with an expiry of up to one year from the user interface. Use the API to create keys with longer expiry.

Create an API key through the Endor Labs user interface

Select User menu > Settings from the left sidebar.
Select Access Control > API Keys.
Click Generate API Key.
Enter a name to identify the API key.
Select the roles to apply to the API Key. You can choose from the following options:
- Admin
- Read-only
- Code Scanner
- Policy Editor
- On-Prem Scheduler
- Package Firewall User
- AI Audit User
Select the expiry of the API key. You can set the value as 30, 60, 90 days, or one year.
When you create an API key, it applies to the current namespace and all its child namespaces. To prevent the policy from being applied to any child namespace, click Advanced and deselect Propagate this policy to all child namespaces.

Using these credentials, you can configure Endor Labs scans in your CI/CD pipeline. Each session initiated by the API key is valid up to four hours. See scanning with endorctl for details.

Create an API key through Endor Labs API

Run the following command to generate and API with the create API Key endpoint.

endorctl api create -r APIKey --data '{
  "meta": {
    "name": "API Key name",
    "description": "API key description"
  },
  "spec": {
    "permissions": {
      "roles": ["SYSTEM_ROLE_ADMIN"]
    },
    "expiration_time": "2025-05-01T00:00:00Z"
  }
}

You can use the following values in spec.permissions.roles:

SYSTEM_ROLE_ADMIN
SYSTEM_ROLE_READ_ONLY
SYSTEM_ROLE_POLICY_EDITOR
SYSTEM_ROLE_CODE_SCANNER
SYSTEM_ROLE_PACKAGE_FIREWALL
SYSTEM_ROLE_AI_AUDIT

Use SYSTEM_ROLE_AI_AUDIT for API keys that ship with Coding Agent Governance hooks on developer machines. See authorization roles for more information. You can provide a specific value for the expiration date of the token. You can also set an expiry of over one year if required. You cannot edit the expiry after you create the API key. If you want to change the expiry, create a new API key with the required expiry date. For example, you want to create an API key for a CI/CD pipeline that expires on March 31st 2026. Run the following command to create an API key with SYSTEM_ROLE_CODE_SCANNER role so that you can use it for endorctl access from a CI/CD pipeline.

endorctl api create -r APIKey --data '{
  "meta": {
    "name": "CI/CD Access API key",
    "description": "API key for use within the CI/CD pipeline"
  },
  "spec": {
    "permissions": {
      "roles": ["SYSTEM_ROLE_CODE_SCANNER"]
    },
    "expiration_time": "2026-03-31T00:00:00Z"
  }
}'

{
  "meta": {
    "create_time": "2025-03-11T16:29:06.127975636Z",
    "created_by": "xxxxxx@endor.ai@google@api-key",
    "description": "API key for use within the CI/CD pipeline",
    "kind": "APIKey",
    "name": "CI/CD Access API key",
    "update_time": "2025-03-11T16:29:06.127975636Z",
    "updated_by": "xxxxxx@endor.ai@google@api-key",
    "version": "v1"
  },
  "spec": {
    "expiration_time": "2026-03-31T00:00:00Z",
    "issuing_user": {
      "meta": {
        "name": "xxxxxx@endor.ai@google@api-key"
      },
      "spec": {
        "email": "",
        "first_name": "",
        "last_login_time": "2025-03-11T16:29:06.114662511Z",
        "last_name": "",
        "user_name": ""
      }
    },
    "key": "endr+foo",
    "permissions": {
      "roles": [
        "SYSTEM_ROLE_CODE_SCANNER"
      ]
    },
    "secret": "endr+bar"
  },
  "tenant_meta": {
    "namespace": "demo"
  },
  "uuid": "67dx6x6x6f69xxx777a41cda"
}

API key expiry reminders

Endor Labs sends email notifications before an API key expires so that you can replace the key before your integrations break. Notifications go out 30, 14, 7, 3, and 1 day before the expiry date of a key. You don’t need to set up anything to receive them. Each notification lists the name, key ID, namespace, permissions, and expiry date of every key it covers. Select the name of a key in the email to open that key in the Endor Labs user interface. The following diagram shows who receives a notification for a key. The recipients depend on whether the key records the email address of its creator.

The user who created the key: If the API key records the email address of its creator, that user receives every notification for the key.
Users with the Admin role: If the API key does not record the email address of its creator, the users with the Admin role receive every notification for the key. They also receive the 3-day and 1-day notifications for keys that do record a creator.

Each recipient gets at most one notification a day, even when several keys qualify. The email lists each key once, sorted by the soonest expiry date. When a key in the list expires in three days or less, the subject line of the email starts with Action Required. A key that you delete or replace drops out of the next notification.

Delete an API Key

Delete the API keys that are expired or no longer in use. You can delete API keys using the Endor Labs user interface or using the Endor Labs API.

Delete an API key through the Endor Labs user interface

Select User menu > Settings from the left sidebar.
Select Access Control > API Keys.
Find the API key that you want to delete and click Delete.

Delete an API key through Endor Labs API

Run the following command to delete an API key with the delete API Key endpoint.

endorctl api delete -r=APIKey --name=<API_Key_Name>

The command fails if there are multiple API keys with the same name. You can use the UUID to delete a specific API key.

endorctl api delete -r=APIKey --uuid=<API_Key_UUID>

Introduction

Setup & Deployment

Inventory & Insights

Scan with Endor Labs

Risk Remediation

Integrations

Secure AI Coding

Platform Administration

Best Practices

Threat Center

Trust & Compliance

Create an API key

Create an API key through the Endor Labs user interface

Create an API key through Endor Labs API

API key expiry reminders

Delete an API Key

Delete an API key through the Endor Labs user interface

Delete an API key through Endor Labs API

​Create an API key

​Create an API key through the Endor Labs user interface

​Create an API key through Endor Labs API

​API key expiry reminders

​Delete an API Key

​Delete an API key through the Endor Labs user interface

​Delete an API key through Endor Labs API

Create an API key

Create an API key through the Endor Labs user interface

Create an API key through Endor Labs API

API key expiry reminders

Delete an API Key

Delete an API key through the Endor Labs user interface

Delete an API key through Endor Labs API