Cernexa
All docs

Integrations & Setup

API keys & programmatic access

Create per-organization API keys for the Supply Chain Gateway and other programmatic access.

API keys give programmatic, per-organization access to Cernexa — most importantly to the Supply Chain Gateway for gating installs in CI and from AI coding agents.

Create a key

  1. Go to API & Automations.
  2. In the API Keys section, create a new key and give it a name (for example, ci-pipeline).
  3. Copy the key immediately — it is shown once. Cernexa stores only a hash, so it cannot show you the value again.

Keys are listed with their name, a truncated preview, the creation date, and when they were last used. Revoke a key at any time to cut off its access.

Use a key

Send it as a bearer token:

curl -sS https://<your-server>/api/gateway/check \
  -H "Authorization: Bearer $CERNEXA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem":"npm","name":"left-pad","version":"1.3.0","source":"ci"}'

Good practice

  • One key per system. Separate keys for CI, pre-commit, and any agent integration so you can revoke one without disrupting the others.
  • Store as a secret. Keep keys in your CI secret store or a vault — never commit them.
  • Rotate on exposure. If a key may have leaked, revoke it and issue a new one.

Note: tool keys vs. API keys

Cernexa API keys (above) are hashed verification tokens you present to Cernexa. They're different from third-party tool keys like your VirusTotal key, which Cernexa must use on your behalf and therefore stores encrypted (reversibly) rather than hashed.

Related