Set up API access

Before you start Open Administration and go to API access. You'll need organization administrator access.

1. Create a key with a name that identifies its purpose; it's given a key prefix so you can recognize it later.
2. Grant it to at least one project with a project role — every key must have at least one grant; those grants are its project membership.
3. Set an expiry — keys do not remain valid indefinitely.
4. Copy the full key when it's shown — it appears once, at creation, and for security isn't displayed again.

Result A named, project-granted, expiring key for a single integration. See API access.

Before you start Stay on Administration → API access, under CI evidence ingest.

1. Set submission caps (results, JUnit bytes, and keyless limits as needed).
2. Optionally require a verified DSSE attestation on every submission.
3. Add trusted builders (required for any attested submission), then upload trusted PEMs and/or keyless identities plus a pinned public-good Sigstore trust root.
4. Save with an electronic signature.

Result Pipelines can submit only within your policy; each successful submission creates a new automated run. Full walkthrough: Configure CI evidence ingest.

1. Have the integrating system include its API key on each request, as described in the API documentation linked from this area.
2. Treat keys as secrets — scoped narrowly and stored securely by the system that uses them.

Result Programmatic access that's as controlled as interactive access.

1. Revoke any key that's no longer needed or might be compromised — revoking it immediately cuts off the access it granted.
2. Because each integration uses its own named key, retire one without affecting other keys or users; a revoked key is marked as such.

Result Access you can withdraw cleanly, with a clear record of what was issued and what was revoked.