Authentication
Create and use account API keys with scan permissions.
Send an API key in the Authorization header on every submit and poll request.
Authorization: Bearer YOUR_API_KEYCreate a key
Section titled “Create a key”Open API Keys in the Control Plane, name the key, and copy its secret when shown. Store it in an environment variable or secret store.
An API key belongs to your personal account. All keys on that account share the same usage counters. Organization enrollment is separate from API access.
Free and Personal allow one active API key, Pro allows five, and Business supports unlimited keys. Revoke an unused key before creating a replacement when your plan’s active-key limit is reached.
Permissions
Section titled “Permissions”| Operation | Required scope |
|---|---|
POST /api/v1/scan | scan:write |
GET /api/v1/scan/{job_id} | scan:read |
The Control Plane creates keys with both scopes. A different key on the same account can retrieve a job if it has scan:read. A key from another account cannot retrieve it.
Revoke or replace a key
Section titled “Revoke or replace a key”Revoke a key from API Keys. To rotate a key, create its replacement, update your application, verify a scan, and then revoke the old key.
Keep API keys out of browser JavaScript, public repositories, and logs. Public websites should send requests through a backend.
Missing or invalid credentials return 401. A valid key without the required scope returns 403. See errors and retries.
For remote MCP, prefer the built-in OAuth flow: configure https://control.patronus.studio/api/mcp and approve the browser prompt. Compatible clients discover the authorization endpoints automatically and receive a 14-day, revocable key through Authorization Code + PKCE. Manually provisioned API keys remain available for clients that only support a static Bearer header.