API keys
One key per environment and per job, scoped to what that job needs.
curl https://api.aux0.com/v1/chats \
-H "Authorization: Bearer aux0_live_7fd2..."A bearer token, and nothing else. There is no second credential.
One key per job
The prefix says which environment a key belongs to: aux0_live_ or
aux0_test_. A test key cannot reach production data, which is the point.
Create a separate key for each thing that calls aux0 — your API server, your worker, CI, a partner's pilot. When one needs revoking, only that one stops.
Scopes
A key can be restricted to a subset of the API:
curl https://api.aux0.com/v1/keys \
-H "Authorization: Bearer $AUX0_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Lumen pilot (read-only)",
"environment": "production",
"scopes": ["chats:read", "messages:read", "accounts:read"]
}'A key without messages:write cannot send a message. That is a better
guarantee than a code review, and much better than a prompt if the caller is
an agent.
Available scopes: accounts:read, accounts:write, chats:read,
messages:read, messages:write, emails:read, emails:write,
people:read, people:write, posts:read, posts:write, webhooks:write,
keys:write.
Rotation
Keys do not expire. Rotate by creating the new one, deploying it, confirming the old one's last used has stopped moving, then revoking it. Revoking is immediate and cannot be undone; the key stays in the audit log by name so past entries still make sense.
If one leaks
Revoke it in the dashboard, then read the audit log filtered to that key. Every call is recorded with a request id, so you can establish exactly what was done with it rather than assuming the worst or the best.