Authentication

The API, the CLI and the MCP server all use API keys. Send a key as a bearer token:

curl https://app.outqube.com/api/v1/runs \
  -H "Authorization: Bearer $OUTQUBE_API_KEY"

Keys start with oq_. The CLI and the examples in these docs read the key from the environment variable OUTQUBE_API_KEY.

Create a keyCopy Anchor Link

An organisation admin creates keys in Settings, API keys.

1. Select Create API key.
2. Enter a name that says where the key is used, for example GitHub Actions.
3. Pick the app. A key belongs to one app and can only see that app. Anything else, including another organisation's run, answers 404.
4. Pick a scope (below) and an expiry: never, or after a number of days up to one year.
5. Copy the key. You see it once. Outqube keeps only a hash and the last four characters.

Creating and revoking keys is only possible in the app, not through the API.

ScopesCopy Anchor Link

Each key has one scope, and each scope includes the ones above it. Too low a scope answers 403.

Use the lowest scope that does the job. A key for a coding agent that only debugs failures can be read. A key for CI needs trigger.

Rotate a keyCopy Anchor Link

Outqube has no rotate button for API keys. Rotate by replacing:

1. Create a new key with the same app and scope.
2. Put the new key in your CI secret store or environment.
3. Check that your jobs pass with it.
4. Revoke the old key in Settings, API keys. It stops working at once.

A missing, unknown, revoked or expired key answers 401. Setting an expiry date means a forgotten key stops working on its own.

See where a key is usedCopy Anchor Link

Settings, API keys shows where each key is used: the client, its version, OS, CI repo or machine name, the last IP and a request count. Clients name themselves with an optional x-outqube-client header (the CLI sends one); anything else is shown by its User-Agent. A key is not a session: to cut a client off, revoke the key.

Keep keys safeCopy Anchor Link

• Keep keys in your CI secret store. Never commit one or put one in a browser.
• Pull requests from forks get no secrets in GitHub Actions, so the key is empty there and the CLI exits 3.
• The CLI never prints your key, and everything it prints passes through a filter that replaces it.
• Each key may make 120 requests a minute by default. See Errors, pagination and limits.

Next stepsCopy Anchor Link

• Quickstart: use your key to start a run.
• Errors, pagination and limits: what 401, 403 and 429 mean.
• CLI reference: outqube login saves a key for your user.