Docs / API keys & roles

Every key carries its own role

Roles are per-key, not per-user, so a CI pipeline's key and a person's key can carry different permissions even inside the same organization.

Admin

Everything Member can do, plus creating and revoking API keys. Your first key (from signup) is Admin.

Member

Create and delete pools, subnets, and addresses. Cannot manage API keys.

Read-only

Read access to pools, subnets, and addresses. Every write request is rejected: the right role for a monitoring or reporting integration.

Creating a scoped key

Requires an Admin key. A Terraform pipeline that only needs to create and update infrastructure, never manage credentials, should use a Member key, not the Admin key from signup.

curl -X POST https://nxip.dev/v1/api-keys \
  -H "x-api-key: $NXIP_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-terraform", "role": "MEMBER" }'

Like your first key, the raw value is only returned once. Store it in your CI secret store, not in version control.

Back to all docs, or the full API reference.