API Keys

An API key authenticates requests to ALTR’s APIs using HTTP Basic Authentication. ALTR auto-generates the key’s Key Name — the HTTP Basic Auth username, in the format ALTR-<hex string> — when you create the key; it isn’t user-controlled and is distinct from the Description you enter. The password is the API key’s secret.

An API key inherits the full permissions of the administrator who creates it. A key can’t be scoped to a subset of permissions. API keys don’t expire; to rotate a key, create a replacement and disable the old one.

Actions taken with an API key are attributed to the creating administrator in ALTR’s System Audit Log, including actions performed by a third-party integration — such as Terraform or a CI/CD pipeline — that uses the key.

Note

API keys are managed from the API tab under Settings > Preferences.

Create an API Key

To create an API key:

1. Select Settings > Preferences in the navigation menu.
2. Click the API tab.
3. Click Add New. ALTR opens the new-API-key dialog.
4. Enter a Description for the API key.
5. Click Create API Key. ALTR displays the New API Key Secret/Password dialog, showing the auto-generated Key Name (the HTTP Basic Auth username) alongside the API key secret.
6. Click Copy to copy the API key secret. The secret is shown only once and can’t be retrieved after you close the dialog, so store it securely.

Disable or Enable an API Key

Disabling an API key stops it from authenticating requests without deleting it. If you disable a key that’s in use, requests made with that key fail.

To disable or enable an API key:

1. Select Settings > Preferences in the navigation menu.
2. Click the API tab.
3. Double-click the API key you want to change.
4. Click the toggle to enable or disable the key.

Note

For the full list of ALTR’s APIs, see the API index.