aether api-key

API keys are the credentials meant for automation. They start with aether_sk_live_, carry scopes, and are shown in full exactly once, at creation. Background in access keys and API keys.

Where each command works

What is restricted is handing out capability: creating a key, extending its expiry, or adding a scope it does not already have. Those happen in the dashboard, under API Keys. A credential able to mint credentials renews itself forever, and revoking the leaked one leaves its offspring alive.

Everything else works from the CLI as before. Listing, revoking, renaming, and narrowing a scope set take away capability or leave it unchanged, so any login session can do them. The moment you suspect a key is loose, the terminal you are already in can revoke it.

aether api-key ls
aether api-key rm <id>
aether api-key patch <id> --name renamed-key

Subcommand	Where	Flags	Purpose
add <name>	Dashboard	—	Create a key, scoped to deploy, apps or read, optionally with an expiry.
patch <id>	CLI, except widening	--name, --scopes, --ttl	Rename a key or narrow its scopes from anywhere. Adding a scope or changing the expiry needs the dashboard. --scopes replaces the whole set.
list, ls	CLI or dashboard	--format, --include-revoked	List keys. Revoked keys are hidden unless --include-revoked is set.
remove, rm <id>	CLI or dashboard		Revoke a key. Asks for confirmation; needs --force in non-interactive mode.

A refused call answers 403 with code dashboard_session_required. If you are signed in to the dashboard and still see it, sign out and sign in again: sessions created before this rule cannot be identified as dashboard sessions.

Scopes

deploy, apps and read are enforced: a key without the scope a route requires is refused.

The keys scope is inert. It used to open the API key endpoints, which is exactly the self-renewal this closed, so it now grants nothing. Existing keys that carry it keep working for everything else. Do not assign it to new keys.

Assign the narrowest set that does the job. A key used only by CI to ship a release needs deploy.