How-to

Issue an API token

Interactive login is for people. Unattended jobs should present a long-lived, revocable sk_ token with a fixed set of roles.

The raw secret is shown once. Only a hash is stored. A database copy is not enough to impersonate the token.

In the console

Open Access (or Settings, depending on your nav) → API tokens.
Create a token. Name it for the job (ci-deploy, metrics-scraper), not the person who clicked.
Pick the smallest roles that work. A scraper needs a viewer; a deploy job needs an operator.
Set expires_in_days unless you have a rotation process that revokes on a schedule.
Copy secret. Put it in your secret store. It will not be shown again.

From the API

You need an existing session (or another token) with runtime:identity:write.

curl -s -X POST "$SIRIUS/api-tokens" \
  -H "Authorization: Bearer $ACCESS" \
  -H 'content-type: application/json' \
  -d '{
    "tenant_id": "default",
    "name": "CI pipeline",
    "roles": ["operator"],
    "expires_in_days": 90
  }'

{
  "secret": "sk_…",
  "token": {
    "id": "…",
    "name": "CI pipeline",
    "prefix": "sk_…",
    "roles": ["operator"],
    "revoked": false
  }
}

Use either header from then on:

curl -s "$SIRIUS/components?tenant_id=default" \
  -H "Authorization: Bearer sk_…"

curl -s "$SIRIUS/components?tenant_id=default" \
  -H "X-API-Key: sk_…"

List metadata (never the secret) with GET /api-tokens?tenant_id=. Revoke with DELETE /api-tokens/{id}?tenant_id= — immediate and idempotent.

Hygiene

One token per job. Do not share a CI token with a laptop script.
Prefer expiry plus rotation over a never-expiring key.
Attribute service calls with X-Sirius-Actor-Type: service and X-Sirius-Actor-ID so audit stays honest.
Local evaluation stacks may run without an authenticator. Production should not.

See the REST API for the auth chain and Connect an identity provider for SSO.