Authentication
API keys belong to the workspace. Each has a name and controls every output, or only the outputs you choose.
Make a key
- In Airframe, open Organisation settings and find API keys. Owners and admins manage keys, and they come with the Solo and Studio plans.
- Choose New key, name it after what will use it, for example
Companion in the gallery. - Choose what it controls: All outputs, including ones made later, or Chosen outputs.
- Copy the key. It's shown once. If you lose it, revoke it and make another.
Keys look like afk_…. Older output tokens, which look like afo_…, still work the same way.
Send it
Send the key as a bearer token on every request:
Authorization: Bearer afk_…
Browsers can't set headers on a WebSocket, so the control WebSocket also takes it as ?token=.
Anyone with a key can run the outputs it controls. Keep keys out of front-end code and version control, and revoke a key straight away if it leaks.
What a key can do
A key runs the show on the outputs it controls, the same as an operator in the control room:
- Read an output's state and the composition it plays.
- Run commands, over HTTP or the control WebSocket.
- List, create, change and remove instances.
It can't change what the show is. Editing and publishing compositions, and choosing which version an output plays, happen in Airframe.
Change or revoke a key
Choose Edit on a key to rename it or change the outputs it controls; changes apply on its next request. Revoke stops it working at once. Each key shows when it was last used, so you can spot ones nothing uses any more.