API Keys

What are API keys?

API keys let you authenticate to the Shieldome REST API and CLI tool without using your account password. You can create multiple keys — for example, one per CI/CD environment — and revoke them individually.

Generating an API key

1. Log in and go to Account → API Keys
2. Click Generate New Key
3. Give the key a descriptive name (e.g. github-actions-prod)
4. Copy the key immediately — it is shown only once

Using API keys

In HTTP requests

curl -H "X-Shieldome-Key: sk_live_xxxxxxxxxxxx" \
     https://yourdomain.com/api/scans

With the CLI

Set the key as an environment variable so the CLI picks it up automatically:

# Add to ~/.bashrc or ~/.zshrc
export SHIELDOME_API_KEY="sk_live_xxxxxxxxxxxx"

# Or set per-command
SHIELDOME_API_KEY=sk_live_xxx python cli.py scan https://example.com

In GitHub Actions

# Store as a repository secret: SHIELDOME_API_KEY
- name: Run Shieldome scan
  env:
    SHIELDOME_API_KEY: ${{ secrets.SHIELDOME_API_KEY }}
  run: python cli.py scan ${{ vars.TARGET_URL }} --type both

Revoking a key

1. Go to Account → API Keys
2. Find the key you want to revoke
3. Click Revoke

Revoked keys stop working immediately. Any running scans authenticated with that key will complete, but new requests will be rejected.

Key lifecycle

API keys do not expire automatically. They remain valid until you explicitly revoke them. There is no inactivity timeout.

Recommended rotation schedule:

• Every 90 days for production/CI environments
• Immediately after a suspected compromise, leaked commit, or team member departure

To rotate a key: generate a new one, update the secret in your CI/environment, then revoke the old key. Both keys are valid during the transition window — there is no downtime.

Key limits

All accounts support up to 5 active API keys. To add a new key when you've reached the limit, revoke one of the existing keys first.

Security best practices

• Use one key per environment (dev, staging, production, CI)
• Store keys in environment variables or a secrets manager — never in source code
• Rotate keys periodically and always after a suspected compromise
• Revoke keys that are no longer in use