An Okibi API key lets okibi act as you. It manages your Okibi account and CLIs. It is not a key for your own API. You manage keys with okibi keys.
Login keys and locked keys
| Login key | Locked key | |
|---|---|---|
| Made by | okibi auth login | okibi keys create |
| Works in | Any workspace where you are an owner, admin, or builder | Only the workspace it is locked to |
| Use it for | Your own machine | CI jobs and shared machines |
Every key acts as you, with your role in the workspace. If you are removed from a workspace, your keys stop working there. Keys start with okb_.
The key on your machine
okibi auth login creates an unrestricted key named okibi CLI via browser and stores it on this machine. Log in explains where it is stored.
The key's home workspace is the one you pick on the approval page. okibi uses it whenever you don't pass --workspace or set OKIBI_WORKSPACE.
okibi auth logout removes the key from this machine, but the key stays active. Each new login makes a new key, so revoke old ones you no longer use.
Create a locked key
okibi keys create --name github-actions --workspace acmeokibi prints the key once. Copy it into your secret store right away; Okibi can't show it again. Without --workspace, the key is locked to your default workspace.
Add --use to store the new key as this machine's key instead of printing it. Your previous key stays active until you revoke it.
You create, list, and revoke keys with a login key. A locked key can't manage keys, so a leaked one can't make more.
What a locked key can't do
A locked key works only in its own workspace. It can't:
- Target another workspace, or list your other workspaces
- Create, reset, or delete workspaces
- Invite people, cancel invitations, change roles, or remove members
- Change the plan or open the billing portal
- Remove a repository from the Okibi GitHub App
- Change Okibi Identity credentials
Use a login key for these.
Use a key in CI
Store the key as a secret named OKIBI_API_KEY. okibi reads it from the environment, so the job doesn't log in:
okibi --agent clis show my-cliAgent and CI mode shows a full job.
List and revoke keys
okibi keys list okibi keys revoke <key-id>
okibi keys list shows every key you own, in all your workspaces. Each row has the key's ID, name, prefix, created date, last used date, and whether it is active or revoked.