Skip to content
GERION
ES EN

API Keys

API Keys are the long-lived credentials used by the CLI and CI/CD pipelines to authenticate with Gerion. They are managed from the dashboard — there is no public endpoint to create or revoke them.

Creating an API Key

  1. Log in to the dashboard at https://app.gerion.dev.
  2. Go to Settings → API Keys.
  3. Click Create New Key.
  4. Fill in the fields:
    • Name: descriptive name (e.g. jenkins-prod).
    • Client ID: unique client identifier, 3–50 alphanumeric characters with ., -, _. Must be unique within your organization and match the client_id you use when calling the authentication endpoint.
    • Permissions: select the required permissions (see table below).
    • Expires at: optional expiration date. Recommended for CI/CD credentials.
  5. Copy the generated API Key. You will not be able to see it again.

Available permissions

PermissionDescription
write:findingsUpload security findings (POST /api/v1/findings). Required for the CLI.
read:findingsQuery findings (internal access via dashboard).

For standard CLI use, the minimum required permission is write:findings.

Using keys in CI/CD

Once created, configure the key as a secret in your pipeline and reference it as environment variables:

Ventana de terminal
# Variables required by the CLI
GERION_API_URL=https://api.gerion.dev
GERION_API_KEY=<your-api-key>
GERION_CLIENT_ID=<your-client-id>

See the CI/CD guides section for platform-specific examples.

Revoking or deleting an API Key

From the dashboard under Settings → API Keys, you can:

  • Revoke: disables the key immediately without deleting it (auditable).
  • Delete: permanently removes the key.

Any JWT generated with a revoked or deleted key will become invalid on the next verification.

  • Production CI/CD: rotate every 90 days. Use the expiration date to enforce this.
  • Development runners: no expiration is acceptable if the environment is isolated.
  • In case of a leak, revoke immediately from the dashboard and create a new key.