API keys

API keys let something other than a browser reach your workspace — the askvoro CLI in CI, or your own scripts.

Create them in Settings → API keys.

Handling them#

Copy it when it's shown. Keys are stored hashed, so we can't show it to you again. Lose it and you create a new one.

Environment variables, not source control. A key in a repository is a key on every laptop that ever cloned it.

One key per use. A key for CI and a key for your local machine means revoking one doesn't break the other, and you can tell from the name what broke when you do.

Revoke rather than reuse. Someone leaves, a laptop goes missing, a key ends up in a log — revoke it. Creating another takes seconds.

The CLI's own key#

askvoro login creates a key for you automatically, scoped to reading and writing articles and FAQs and nothing else, and stores it in ~/.config/askvoro/credentials.json with user-only permissions.

That's the right key for a laptop. For CI, create one in the dashboard and pass it as ASKVORO_TOKEN — see the CLI section.

API keys and signing secrets are different things#

Easy to confuse, so:

An API key authenticates you calling us. It goes in a request to AskVoro.

A signing secret proves we are calling you. It verifies a webhook we send to your backend. See the webhook contract.

Different directions, different secrets. Neither substitutes for the other.