> ## Documentation Index
> Fetch the complete documentation index at: https://www.minitap.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, copy and revoke the workspace keys that sign the Minitap CLI and your CI pipelines in.

An API key lets the `minitest` CLI start runs and read results without a person signing in, which is what your CI needs. This page covers creating a key, using it in a pipeline, and revoking it.

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
export MINITEST_API_KEY=mtk_...
minitest --json apps list
```

Keys belong to the workspace and start with `mtk_`. Owners and admins manage them in **Settings → API keys**.

## Create a key

**1. Open the API keys page**

Go to **Settings → API keys** and click **Create key**.

**2. Name it**

Give the key a name you'll recognize later, like `GitHub Actions` or `Nightly Jenkins`, up to 80 characters. Click **Create key**.

**3. Copy it now**

The dialog shows the key once. Click **Copy API key**, or **Copy export command** for a ready-to-paste `export MINITEST_API_KEY=...` line, and store it in your CI's secret store. After you click **Done**, the full key can't be shown again.

Create one key per place that uses it: one per CI pipeline, one for your laptop. You can then revoke one without breaking the others. A workspace can have up to 100 active keys.

The list shows each key's name, its first characters, when it was created, who created it and when it was last used. Keys don't expire, so **Last used** is how you spot one nobody needs anymore.

## Use a key in CI

The CLI reads the key from the `MINITEST_API_KEY` environment variable. Store the key as a secret in your CI and expose it under that name:

```yaml theme={"theme":{"light":"github-light","dark":"vesper"}}
env:
  MINITEST_API_KEY: ${{ secrets.MINITEST_API_KEY }}
steps:
  - run: minitest --json apps list
```

The same works in GitLab CI, CircleCI, Jenkins, Azure Pipelines or Bitbucket Pipelines: set the variable, install the CLI, and run any command. See [Run in CI](https://www.minitap.ai/docs/minitest/runs/ci.md) for complete pipelines.

On your own machine you don't need a key: `minitest auth login` signs you in through the browser.

> [!NOTE]
>
> The [GitHub Action](https://www.minitap.ai/docs/minitest/reference/minitest-trigger-action.md) needs no API key. It signs in with the workflow's GitHub OIDC token, so the only thing to set is `id-token: write` in the workflow's permissions.

Treat a key like a deploy token: never commit it, and keep it out of logs. A key from this page works for every app in the workspace.

## Revoke a key

In **Settings → API keys**, click the revoke button on the key's row, then **Revoke key**. Anything using that key stops working right away, and this can't be undone.

To rotate a key without downtime, create the new key first, update the secret in your CI, check that a pipeline runs, then revoke the old key.

The CLI can manage keys too, for scripts. It needs a signed-in session, so run it after `minitest auth login`:

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
minitest auth api-key mint --tenant <workspace_id> --name ci-runner-v2 --json
minitest auth api-key list --tenant <workspace_id> --json
minitest auth api-key revoke --tenant <workspace_id> --key <old_key_id> --json
```

See [`auth api-key`](https://www.minitap.ai/docs/minitest/reference/cli-commands#auth) in the CLI reference.

## Next steps

> [card] [Run in CI](https://www.minitap.ai/docs/minitest/runs/ci.md)
>
> Start runs from your pipeline and act on the verdict.

> [card] [CLI commands](https://www.minitap.ai/docs/minitest/reference/cli-commands.md)
>
> Every `minitest` command and flag.

> [card] [Members and roles](https://www.minitap.ai/docs/minitest/workspace/members.md)
>
> Who can create and revoke keys.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.