API keys
Works locallyWorks in the local build today.
Limit each key to what it needs.
harebox api-key new --name ci-runner --preset ci
harebox api-key list
| Preset | Use |
|---|---|
read_only |
Inspect |
tenant |
One sandbox; can't create more or read billing |
full_sandbox |
Operate a sandbox |
ci |
Create and manage its own sandboxes |
admin |
Everything |
Keys can also carry a sandbox list, IP allowlist and expiry. Keys last 90 days by default. A key can never grant a scope its creator lacks.
Rotation has an overlap, so nothing breaks while you deploy the new secret:
KEY=$(harebox api-key new --name rotate-me --preset read_only | jq -r .id)
harebox api-key rotate "$KEY" --overlap-seconds 3600
harebox api-key revoke "$KEY"