Authentication

Every request to the Cybros API is authenticated with an API key sent as a bearer token. This page covers creating and rotating keys, the header format, how the CLI/SDKs resolve credentials, and security guidance.

API keys

Cybros API keys are prefixed cybros_sk_ (secret key). A key belongs to an org and carries a role that bounds what it can do.

The full secret is shown exactly once, at creation — Cybros stores only a hash plus a display prefix. Store the raw key in a secrets manager; you cannot retrieve it again.

Create a key

Dashboard — go to Settings → API Keys (or the /enterprise page) and create a key. Copy it immediately.

CLI — cybros keys create:

cybros keys create "ci-token" --role member

╭─ API key created ────────────────────────────╮
│ ci-token                                      │
│                                               │
│ cybros_sk_live_3f9c8a1b2c3d4e5f6a7b8c9d0e1f   │
│                                               │
│ This is the only time the key is shown.       │
╰───────────────────────────────────────────────╯

API — POST /api-keys:

curl -X POST https://backend.cybros.hacktigerlabs.com/api/v1/api-keys \
  -H "Authorization: Bearer $CYBROS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-token", "role": "member"}'

List & revoke

cybros keys list
cybros keys revoke key_1a2b...

Listing shows the display prefix…last4, role, and active state — never the full secret.

Rotate a key

There is no in-place rotation; rotate by create → deploy → revoke:

cybros keys create "ci-token-2025q3"   # 1. mint the new key
# 2. update your secret store / CI secret with the new value
cybros keys revoke key_OLD             # 3. revoke the old one

The Authorization header

Send the key as a bearer token on every request:

GET /api/v1/me HTTP/1.1
Host: backend.cybros.hacktigerlabs.com
Authorization: Bearer cybros_sk_...
Accept: application/json

The SDKs and CLI set this header for you. Verify a key any time with:

curl https://backend.cybros.hacktigerlabs.com/api/v1/me \
  -H "Authorization: Bearer $CYBROS_API_KEY"

The API also accepts a Supabase session JWT as the bearer token (this is what the dashboard uses). For programmatic and CI use, always use a cybros_sk_... API key.

Credential resolution (precedence)

The CLI and SDKs resolve the API key and base URL from the same ordered sources. The first source that provides a value wins:

Default base URL:

https://backend.cybros.hacktigerlabs.com/api/v1

The config file

cybros login writes ~/.cybros/config.toml with mode 0600:

api_key = "cybros_sk_..."
base_url = "https://backend.cybros.hacktigerlabs.com/api/v1"

Inspect or edit it via the CLI (the key is masked on read):

cybros config path                 # print the config file location
cybros config get                  # show all values (api_key masked)
cybros config set base_url http://localhost:8000/api/v1

This file is shared by the Python cybros CLI and the gh cybros extension — logging in with either authenticates both.

Per-environment overrides

Point at a self-hosted or local instance without touching the config:

export CYBROS_API_URL=http://localhost:8000/api/v1
# or, one-off:
cybros --api-url http://localhost:8000/api/v1 me

Errors

Auth failures map to typed errors in the SDKs and clear messages in the CLI:

A missing local key (before any request) raises ConfigError (Python) with a hint to run cybros login.

Security notes

• Never commit keys. Use a secrets manager or CI secret (e.g. the CYBROS_API_KEY GitHub Actions secret — see CI).
• Scope by role. Mint least-privilege keys (--role member) for CI and automation; reserve admin keys for humans.
• Rotate regularly, and immediately on suspected exposure — revoke first.
• The config file is 0600, but it still stores the key in plaintext on disk. In the IDE integrations, the key is stored in the OS keychain instead (VS Code SecretStorage / JetBrains PasswordSafe).
• Audit usage. Every key action is recorded in the audit log; query it with client.audit.list(...).