API keys authenticate the CLI. Browser use needs only sign-in.
Install the CLI, then create a key
Install the CLI, then run zerocool auth login.
Open the browser link and approve it. The CLI creates and saves the new key for you.
You do not need to create or copy a key first.
For manual key management, see Create an API key.
| Role | The key can |
|---|---|
| Viewer | Read audits, findings and comments, and check prices |
| Member | Also start, cancel and fork audits, and add comments |
| Admin | Also manage workspace members and funding through the CLI |
A single-workspace key requires direct membership. All workspaces includes future workspace access. The key never exceeds its creator's current access or its selected role ceiling.
Authenticate
Run zerocool auth login. It prints a link. Open it where you are signed in, choose the key's scope, role and expiry, and select Approve.
To save a key that you already have, pipe it to zerocool auth login --with-key-stdin.
For CLI automation, supply ZEROCOOL_API_KEY from a secret store.
Keep keys out of URLs, source control, browser storage, logs and chat.
Use separate keys for separate tools and prefer the narrowest scope.
Expiry, rotation and revocation
Profile → API keys shows expiry and provides Revoke.
To rotate, create a replacement, update its consumers, verify access with zerocool workspaces, then revoke the old key.
There is no in-place rotation button. Expired or revoked keys receive HTTP 401.
If a key is exposed, revoke it and issue a replacement.