Automation API Keys

Each key belongs to one automation client (a script, a cron job) and is checked on every /api/automation/* request via the X-API-Key header — a separate mechanism from the human sign-in above, see the API reference. Keys are hashed at rest and shown in full exactly once, right after creation — if one is lost, revoke it and create a new one. Rate limit is enforced per key, per minute.