API authentication
Workspace-bound keys and device authorization for the Tachyonic API.
Workspace keys
Create keys at Settings > API Keys.
A key is bound to a workspace and carries the scopes selected when it was
created. Send it in the x-api-key header. The service checks it on every
request; a revoked key fails its next request.
| Scope | Purpose |
|---|---|
sandbox:read | List and inspect sandboxes, files, events, and usage |
sandbox:write | Create, execute, write files, resume, and stop sandboxes |
usage:read | Read organization usage and workspace budgets |
budget:write | Set or remove a workspace budget |
scan:read, scan:write | Read or start security-runtime and existing scan workflows |
target:manage | Manage targets |
finding:read, finding:write | Read or update findings |
report:export | Export reports |
governance:read, governance:submit | Read or submit governance records where enabled |
Use only the scopes your integration needs. A key cannot select another workspace by sending identity headers. See Sandbox API and Platform API for their routes.
Device login
tachyonic login
tachyonic whoamiThe CLI opens browser authorization, then receives a workspace-bound device key after approval. It confirms receipt and stores the key locally. Device keys include sandbox and usage scopes, but cannot change budgets. Reauthorize when a key expires or is revoked.
For a console-created key, run:
tachyonic login --with-keyThe command reads stdin or a hidden prompt. It does not need a credential
argument. tachyonic logout clears local login and revokes a device-created
key; --keep-key clears local login while leaving it valid.
CI and API clients
Supply TACHYONIC_API_KEY through the CI secret environment. The CLI reads it
in-process and gives it precedence over stored login. For an HTTP client,
read the value in-process and set the header there:
import os
from urllib.request import Request, urlopen
request = Request("https://api.tachyonic.sh/v1/whoami")
request.add_header("x-api-key", os.environ["TACHYONIC_API_KEY"])
with urlopen(request, timeout=30) as response:
status = response.status
print(status)Keep credentials out of arguments, URLs, shell history, logs, and result
files. TACHYONIC_API_URL selects an API origin; it must not contain a key.
Dashboard sessions and compatibility
The dashboard uses browser session authentication. Sign in at platform.tachyonic.co.
Existing older CLI device-token and refresh routes remain compatibility paths. New device-key login does not use those JWT refresh routes.