API keys

An API key acts for your organization, not for the person who made it. Every member can see every key; owners and admins create and revoke them.

#Before you start

• You need to be an owner or admin of the organization.
• Two-factor authentication (MFA) must be on for your account. You cannot create an API key until it is.
• You need to have signed in recently. If it has been a while, the console asks you to sign in again and brings you back.

#Create a key

1. Open Organization → API keys. It is also in the account menu.
2. Press Create key.
3. Name it after what will use it, like github-actions or terraform-prod, so you know what to revoke later.
4. Choose the access: Read only, or Read and write.
5. Choose when it expires: 7, 30, 60, 90, 180 or 365 days. It defaults to 90. There is no key that never expires.
6. Press Create API key.

An organization can have up to 25 active keys.

#Keys for AI apps

When you connect an AI app, such as Claude or Cursor, the console makes a key for it too. Any member can connect one, not only owners and admins, and the app's key can never do more than that member can. These keys are listed under Organization › AI apps, not on the API keys page, and they do not count toward the 25 above: an organization can have up to 25 connected AI apps as well.

An AI app's key can have a third scope, delete, which only AI apps use. Access levels for AI apps.

#Use a key

Keys start with PAN_. Send yours as a bearer token with each request:

Authorization: Bearer PAN_…

Keep it in an environment variable rather than in your code. A key belongs to one organization, so it is the only thing a request needs to say who it is for. This lists your virtual machines:

$ export PANTECH_API_KEY=PAN_…$ curl https://api.pantechdynamics.com/public/v1/instances \    -H "Authorization: Bearer $PANTECH_API_KEY"

Requests that change something, like creating or deleting a machine, also need an Idempotency-Key header: a fresh UUID per action, reused if you retry it, so a retry never does the work twice.

A key works until it expires or is revoked. It cannot create or manage other keys; that only works from the console. A key can revoke itself, though: DELETE /public/v1/me ends the key that sends it, which is how pantech auth logout signs out. Every request a key makes is recorded: when, from where, what it called and how it ended.

Keys work only on the public API, at /public/v1 on api.pantechdynamics.com. The API reference lists every endpoint, with examples.

#See and revoke keys

The table lists every key with its access, who created it, when it was last used and when it expires. Only the start and end of each key are shown. Keys expiring within 7 days are flagged.

To revoke a key, press Revoke on its row, then Revoke key. Revoking is final: anything using the key starts failing within about 30 seconds. The key stays in the list, under All, as a record.