Authentication

Programmatic access (the CLI, the API, the MCP server) authenticates with an API key. The dashboard uses your signed-in session, so you only need a key for automation.

Create a key

1. Open Dashboard → API keys.
2. Give it a label (e.g. laptop CLI, CI) and click Create key.
3. Copy the key immediately — it is shown once and only stored hashed. It looks like calma_sk_….

You can list and revoke keys from the same page; a revoked key stops working instantly.

Use a key

Set it as an environment variable (the CLI and MCP read it automatically):

export CALMA_API_KEY=calma_sk_...

Or send it as a bearer token when calling the API directly:

curl https://calma-engine.fly.dev/api/jobs \
  -H "Authorization: Bearer $CALMA_API_KEY"

Scope & tiers

A key inherits the tenant and plan it was created under — every request is metered and rate-limited exactly like your dashboard. A key can only ever see or affect your own scans; it cannot mint or revoke keys (that stays in the dashboard, so a leaked key can't escalate).

Treat a key like a password. If one leaks, revoke it in the dashboard and create a new one.