API keys

An API key lets a script or CI job call the TrekShield API as you.

Create a key

1. Open Settings, API Keys and select Create API key.
2. Enter a name (up to 200 characters, for example “CI pipeline”). Optionally set an expiry date, which must be in the future. Leave it blank for a key that does not expire.
3. Select Create and copy the key from the Copy your API key dialog.

The secret is shown only once. TrekShield stores a hash and a short prefix, never the key itself, so a lost key cannot be recovered: revoke it and create another. Keys begin with tsk_.

Client Administrators and Platform Administrators create keys from Settings.

Use a key

Send it on every request in either header:

Authorization: Bearer tsk_...
X-API-Key: tsk_...

The API is versioned under /api/v1 on your TrekShield host.

Permissions

There are no scopes. A key has exactly the role and visibility of the user who created it, so a Client Developer’s key sees only that developer’s assigned work, and the same rules apply as in the web app. A key stops working when it expires, is revoked, or when its owner is deactivated. Invalid keys receive 401.

Manage keys

The list shows each of your keys by name, prefix, last-used date, expiry and creation date. You can see only your own keys. Revoke takes effect immediately and cannot be undone.

To rotate a key, create the new one, update your automation, then revoke the old one.

Good practice

• Treat a key like a password. Keep it in a secret manager, not in source control or chat.
• Use one key per integration, set an expiry, and revoke keys when people leave.
• Remember that a key bypasses the MFA prompt, because it is the credential.

Changes made with a key are recorded in the audit log under your name.

MCP tokens (preview)

Separate read-only tokens beginning tsm_ let an AI assistant read findings, assets and related data over MCP. Administrators create them under MCP Tokens, choose scopes (findings, assets, engagements, action groups, changes, campaigns) and may set an expiry. The feature is not generally available and is not open to customer roles.

Related: webhooks.