API keys

API keys authenticate the acira CLI. You create and manage them in the app under Settings → API Keys, along with your account and active sessions.

Creating a key

Create a key in the app, then hand it to the CLI:

acira auth      # paste the key

Or, for CI and automation, set it in the environment as ACIRA_API_KEY — there's no command-line flag for the key, so it stays out of your shell history and process list.

What a key can do

A key carries your account's identity. It can reach the sites you already have access to, and only through the CLI's endpoints — it doesn't grant anything beyond what your account can already do. If a key is ever exposed, delete it in the app and create a new one; deleting it revokes it immediately.

Good practices

• Use a separate key per machine or CI system so you can revoke one without disrupting the others.
• Prefer the ACIRA_API_KEY environment variable in automation over storing the key in a file.
• Rotate keys periodically and whenever someone with access leaves.

Sessions

The same settings area lists your active sign-in sessions in the app and lets you sign out of them — useful for security hygiene across the devices where you use the dashboard.