API keys

Create a key

Console → API keys → New key. Give it a label you will recognise in an incident ("laptop-cli", "ci-runner"). The key — format pg_live_ + 40 hex characters — is shown once: we store only a SHA-256 hash, so it cannot be re-displayed. Lost key = revoke + new key.

Use it

# REST
curl -H "Authorization: Bearer pg_live_…" https://powergpu.io/v1/instances

# CLI
export POWERGPU_API_KEY=pg_live_…
powergpu list

# Python
client = powergpu.Client()          # reads POWERGPU_API_KEY

Key hygiene

• One key per consumer — a leaked CI key then revokes without breaking your laptop.
• Environment, not code — POWERGPU_API_KEY in your secret store; never commit a key. If a key lands in a public repo, revoke it first, clean git history second.
• Last-used tracking — the keys page shows when each key last authenticated; prune the stale ones.
• Rotation — create the new key, roll consumers, revoke the old. Both stay valid during the overlap, so rotation is zero-downtime.

Revocation

Deleting a key invalidates it within seconds platform-wide. Running instances are unaffected — keys gate the management plane, not the workloads.