API keys are intended for CI, automation, browser extension flows, and other non-interactive clients.

Creation returns the full token only once

When you create an API key, the response includes the full apiKey token a single time. Store it immediately in your secret manager, CI variable store, or extension setup flow.

Create API key

POST/api/settings/api-keysBearer Token

Body:

{
  "name": "CI smoke gate",
  "scopes": ["ci:trigger", "ci:status", "ci:cancel"]
}

Optional: expiresInDays (1 to 3650). Without it, the key does not expire.

If scopes is omitted, Certyn applies the default set: process:execute, quicktest:execute, testcase:read, testcase:execute, ticket:read, ticket:retest, execution:read, chat:use, ci:trigger, ci:status, ci:cancel.

All scopes:

ci:trigger, ci:status, ci:cancel, ci:results
process:execute, quicktest:execute
testcase:read, testcase:write, testcase:execute
ticket:read, ticket:write, ticket:retest
execution:read
chat:use
mcp:use (needed to call the MCP server with this key; not in the default set)
runner:manage
platform:manage

Any other scope is rejected with 400.

For CI pipelines, pick by direction:

to trigger a Certyn run and gate on it, use ci:trigger, ci:status, and ci:cancel
to push your own test results in, use ci:results

Delete API key

DELETE/api/settings/api-keys/{id}Bearer Token

Auth header format

For direct HTTP calls, send API keys with:

curl -H "X-API-Key: cyn_live_<...>" https://api.certyn.io/api/projects/overview

Certyn also accepts:

Authorization: ApiKey cyn_live_<...>
Authorization: Bearer cyn_live_<...>
?access_token=cyn_live_<...> in the URL, for WebSocket and SSE connections

Notes

API key management endpoints are JWT-only.
The create/delete REST surface is public and documented here.
The full token is never returned again after creation.