Skip to content
Sudomimus

Self-service AccessKeys

View as Markdown

An AccessKey is a long-lived credential that lets a CLI, service, launcher, or other headless client use your account with an application that explicitly allows AccessKey direct-issue.

Use AccessKeys only when the client cannot send you through an interactive browser login. For public CLIs and launchers where the user can approve a browser code, Device Authorization is often the safer fit.

Before creating a key

Section titled “Before creating a key”

Check that:

  • The target application is the one you expect.
  • The application allows the ACCESS_KEY_DIRECT authentication method and DIRECT_ISSUE return method.
  • You are comfortable with the claims the application requests.
  • You can store the generated secret safely. It is not available from later key-list or detail reads.

Create an AccessKey

Section titled “Create an AccessKey”

In with.sudomimus.com:

  1. Open Account → Access keys.
  2. Choose the application.
  3. Review the requested claims and consent prompt.
  4. Create the key.
  5. Store the secret in your password manager, secret store, CI variable, or service configuration.

The key is bound to your own account. It cannot create a new account and it cannot act as another user.

If the network fails while the key is being created, retry without changing the form. The portal keeps the same operation identifier and can recover that exact result for up to ten minutes instead of creating a second key. This is recovery for an uncertain create response, not a general reveal feature; after the window, replace a lost secret by creating a new key and revoking the old one.

Section titled “Consent at creation time”

AccessKey clients often run without a browser, so the portal collects claim consent before minting the key. If the application requires your email, name, or avatar, review that request carefully.

If required claim data is missing, complete your profile first. If you deny a required claim, the key cannot be created for that application.

Revoke or rotate a key

Section titled “Revoke or rotate a key”

If a key is no longer needed or might have leaked, revoke it from Account → Access keys.

Rotation means:

  1. Create a new key.
  2. Update the client or service to use the new secret.
  3. Revoke the old key.
Section titled “Related”