Access

API keys

Give scripts and CI a user or organization delegation, then authenticate the CLI with its API key.

Create a key

Open API keys in the console menu. Choose User for your own permissions or Org for organization resources; only organization owners and admins can manage Org keys. Enter a delegation name and expiry, then copy the key. Platform shows the secret once.

CLI authentication and delegation commands require Zeroshot 10.16 or newer. To create a delegation from the CLI, sign in as a human and unset ZEROSHOT_API_KEY:

Create delegations

Zeroshot

zeroshot delegation create ci-build --target platform
zeroshot delegation create org-ci --target platform --owner org --organization ORG_ID
zeroshot delegation list --target platform

Keys expire after 90 days by default. Choose 1–365 days with --expires-in-days.

Use the CLI

Save the key in your CI secret manager as ZEROSHOT_API_KEY. Set ZEROSHOT_ORGANIZATION to the organization ID you want to use, then run your usual CLI commands with --target platform. Machine authentication needs no browser login or system keyring.

A user delegation follows your current permissions and organization memberships. An organization delegation stays in its organization and uses organization resources. Keys support the full CLI except delegation and API key management, which require a human.

Keep this Platform key separate from provider connections. Never put it in a run definition, repository, or command argument. The GitHub App keeps its existing permissions and setup.

Rotate or revoke

Choose Add key on the delegation. Update your clients with the new key, check that they work, then revoke the previous key. Both keys work during the change.

Rotate and revoke keys

Zeroshot

zeroshot delegation key create DELEGATION_ID --target platform
zeroshot delegation key list DELEGATION_ID --target platform
zeroshot delegation key revoke DELEGATION_ID KEY_ID --target platform
zeroshot delegation disable DELEGATION_ID --target platform

Revoking a key blocks its future requests and live access. Disabling a delegation blocks every key it owns. Accepted runs continue; stop them separately if needed. If you lose a newly issued key, revoke it and create another.