Manage API keys

The API keys tab of Settings lets you create keys for scripts, each with a label, a set of permissions and an optional list of addresses it may be used from. You see each key once, when you create it.

Other Coritan credentials do work with their own APIs:

• An organization API key calls the Commerce API for one organization.
• An SMTP Relay API key sends mail with the SMTP Relay API.

• Sign in to the dashboard.

1. In the sidebar, select Settings, then the API keys tab.
2. Select Create API key….
3. Type a Label, such as CI deploys, so you can tell the key apart from your others. It can be up to 100 characters.
4. Under Permissions, tick Read or Write for each area the key needs: Services, Container Apps, Cloud Compute, DNS, Floating IPs, Email, Storage, Websites and Edge Proxy, Billing and Support. A new key starts with Read-only, which ticks every Read box. Select all ticks everything.
5. Optionally, list the addresses the key may be used from in IP allow-list: one IPv4 or IPv6 address or CIDR range per line, such as 203.0.113.10 or 2001:db8::/32. Leave it empty to allow any address.
6. Select Create API key.
7. Copy the key from Copy this key now. It starts with ct_, and Coritan shows it only this once.

Coritan emails you when a key is created.

1. On the API keys tab, select the bin icon at the end of the key's row.
2. Type the key's label to confirm. A key with no label asks for the word revoke.
3. Select Revoke key.

The list shows each key with its label and creation date under Key, then Permissions, Allowed from (Any address when it has no allow-list) and Last used. Last used stays Never, because the API does not accept the keys yet.

Enter a label so you can tell this key apart from your others.

The Label is empty. Type one.

Line 2: enter an IP address or a CIDR range.

A line in IP allow-list is not an address or a range. The message names the line. Fix it or delete it.

401 from the API with a ct_ key

The API does not accept these keys yet. Sign in and use an access token instead, as Make your first API request shows.

You lost a key

Coritan cannot show it again. Revoke it and create another.

• Make your first API request
• Authentication
• Create organization API keys

These endpoints take your access token.

Create a key with POST /auth/me/api-keys. label is required (1–100 characters); permissions and ip_whitelist are optional lists of strings. The dashboard writes permissions as area:read or area:write, such as services:read.

curl -X POST https://api.coritan.com/api/v1/auth/me/api-keys \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label": "CI deploys", "permissions": ["services:read"], "ip_whitelist": ["203.0.113.10"]}'

{
  "id": 17,
  "label": "CI deploys",
  "permissions": ["services:read"],
  "ip_whitelist": ["203.0.113.10"],
  "is_active": true,
  "last_used_at": null,
  "created_at": "2026-09-16T10:02:11",
  "raw_key": "ct_..."
}

raw_key is in this answer only. List your keys, newest first, with GET /auth/me/api-keys. It takes limit (default 200, at most 500) and returns the same fields without raw_key.

Revoke a key with DELETE /auth/me/api-keys/{key_id}. It answers {"message": "API key revoked"}, or 404 API key not found for a key that is not yours or no longer exists.