API Keys

API keys authenticate software that calls the LaserData Cloud API. Use them for CI/CD, CLI tools, Terraform providers, and other integrations. They follow the same permission model as interactive sessions.

How It Works

A key follows this sequence:

1. You create it with a role and optional IP restrictions.
2. The platform shows its generated secret once.
3. You send the secret in the ld-api-key header on each request.
4. The platform evaluates the key, rate limit, IP allowlist, and role permissions.

Save the secret when you create the key. The platform cannot display it again.

Creating an API Key

From the Console

1. Open the tenant's API Keys page.
2. Click Create API Key.
3. Enter a key name.
4. Select an existing role, or enter permissions to create a dedicated role for the key.
5. Set an expiration date no more than 365 days away.
6. Click Create.
7. Copy the secret before you leave the page.

With Inline Permissions

Inline permissions define the tenant, division, and environment grants within the request. The platform creates a dedicated role and ties it to the key.

{
  "name": "monitoring-key",
  "expiry_at": "2026-06-01T00:00:00Z",
  "permissions": {
    "tenant": ["info:read", "member:read"],
    "division": ["environment:read"],
    "environment": ["deployment:read", "deployment:telemetry:read"]
  }
}

permissions.environment applies to every environment in every division. Use permissions.divisions[id].environment for a division's defaults. Use permissions.divisions[id].environments[env_id] for an environment override. Roles & Permissions explains precedence.

Security

IP Allowlisting

An allowlist restricts a key to selected source IPs. Other addresses receive 403. You can change an existing key's IP restrictions without recreating it.

The account plan limits allowed IPs per key:

Managing API Keys

Use the API Keys page for these actions:

• Read each key's name, role, expiry, and creation date.
• Change its IP allowlist.
• Delete it to revoke access immediately.

Creation, updates, and deletion require api_key:manage. Listing requires api_key:read. The audit log records all API key operations.

API Reference

Create an API Key with a Role

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/api_keys \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ci-deploy-key",
    "role_id": 67890,
    "division_id": 123,
    "expiry_at": "2026-06-01T00:00:00Z",
    "validate_ip": false
  }'

Supply role_id for an existing role or permissions for a dedicated role. Do not supply both. The optional division_id limits the key to one division.

Create an API Key with Inline Permissions

curl -X POST https://api.laserdata.cloud/tenants/{tenant_id}/api_keys \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "monitoring-key",
    "expiry_at": "2026-06-01T00:00:00Z",
    "validate_ip": true,
    "allowed_ips": ["10.0.0.1"],
    "permissions": {
      "tenant": ["info:read", "member:read"],
      "division": ["environment:read"]
    }
  }'

List API Keys

curl https://api.laserdata.cloud/tenants/{tenant_id}/api_keys \
  -H "ld-api-key: YOUR_API_KEY"

{
  "items": [
    {
      "id": 1,
      "division_id": 123,
      "division_name": "production",
      "user_id": 1,
      "role_id": 67890,
      "role_name": "deployer",
      "name": "ci-deploy-key",
      "validate_ip": false,
      "allowed_ips": [],
      "expiry_at": "2026-06-01T00:00:00Z",
      "created_at": "2025-01-15T10:30:00Z"
    }
  ],
  "page": 1,
  "total_results": 1,
  "total_pages": 1
}

Update Security Settings

curl -X PUT https://api.laserdata.cloud/tenants/{tenant_id}/api_keys/{api_key_id}/security \
  -H "ld-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "validate_ip": true,
    "allowed_ips": ["10.0.0.1", "192.168.1.0"]
  }'

Delete an API Key

curl -X DELETE https://api.laserdata.cloud/tenants/{tenant_id}/api_keys/{api_key_id} \
  -H "ld-api-key: YOUR_API_KEY"