API Keys
Scoped, expiring tokens for your CI and your own tooling, against the same REST API the Aquanode console runs on.
Same API as the console
There is no second-class public API here. The console is a client of the same endpoints your key reaches, so anything you can do in the UI — list deployments, launch one, read metrics, migrate a workload — is reachable from a script.
Authenticate with an x-api-key header or a standard Authorization: Bearer header, whichever your client makes easier. Keys are prefixed aq_sk_ so they are recognisable in a secret store, and the full token is shown once, at creation — Aquanode cannot show it to you again later.
Scopes, so CI does not get the keys to billing
Every key is created with one of three scopes: Read lists deployments and reads metrics and cannot deploy or migrate; Deploy can deploy and migrate workloads but cannot touch team membership or billing; Full access is everything, including team and billing.
A build pipeline that spins up a GPU for an integration test wants Deploy, not Full. Pick the narrow one — the whole reason the middle scope exists is so a leaked CI token cannot change who is on your team or where the invoice goes.
Expiry and revocation
Choose an expiry when you create a key — 30 days, 90 days, a year, or no expiry if you genuinely need a long-lived one. Deleting a key takes effect immediately: the next request carrying it is rejected.
Keys are scoped to the team, not to your personal login, so a key keeps working when the person who created it moves on — and the console shows the whole team's keys with their scopes in one place.
FAQ
How do I authenticate to the Aquanode API?
Send your key either as an x-api-key header or as an Authorization: Bearer header. Keys are prefixed aq_sk_ and the full token is displayed only once, at creation time.
What scopes can an API key have?
Read (list deployments, read metrics — no deploys or migrations), Deploy (deploy and migrate workloads, but no team or billing access), and Full access (everything, including team and billing).
Can API keys expire automatically?
Yes. At creation you choose 30 days, 90 days, 1 year, or no expiry. Deleting a key revokes it immediately — the next request using it is rejected.
Can I deploy a GPU from CI/CD?
Yes. A Deploy-scoped key can launch and migrate workloads through the same REST API the console uses, which is the intended path for CI/CD pipelines and custom integrations.
Are API keys personal or shared with my team?
Keys are scoped to the team, not to an individual login, so they keep working independently of who created them and the whole team's keys are visible with their scopes in the console.
