Verentis

Documentation

API keys

Create scoped, optionally node-bounded API keys for CI and automation, and manage their grants.

API keys (vrt_…) let scripts and CI authenticate without a browser. Create them with exactly the scopes they need — nothing more.

Create a key

verentis apikey create ci-key \
  --workspace <id> \
  --grant node.file.read \
  --grant execution.execution.run

The secret is shown once on creation — store it somewhere safe (e.g. a CI secret). Use it with verentis login --api-key vrt_… or the VERENTIS_API_KEY environment variable.

--grant <scope...>

Permission scopes to grant the key. Repeatable.

--workspace <id>

Create a workspace-scoped key (otherwise account-scoped).

--node <nodeId>

Confine the key to a node subtree. Requires --workspace.

--principal <id>

The principal the key acts as (default: you). Pair with --principal-type User | Role | Service.

--expires <iso8601>

Optional expiry timestamp.

Manage keys

verentis apikey list --workspace <id>            # --search, --revoked
verentis apikey get <apiKeyId>
verentis apikey update <apiKeyId> --name "New name" --expires 2026-01-01T00:00:00Z
verentis apikey regenerate <apiKeyId>            # rotate the secret
verentis apikey revoke <apiKeyId>

Adjust grants on an existing key

verentis apikey grant add <apiKeyId> node.file.read
verentis apikey grant add <apiKeyId> node.file.delete --deny
verentis apikey grant remove <apiKeyId> node.file.read

Least privilege

A key is only as safe as its scopes. Grant the minimum, prefer --node to confine file access to a subtree, and set --expires for short-lived automation.