Skip to main content
The Settings → API Keys page manages team-scoped API access for automation, CI, and external SDKs. Interactive CLI devices are managed separately under Settings → Account → CLI Sessions.
Onyx uses a refreshable WorkOS public-client session for interactive login; it does not generate an API key. Desktop login uses browser PKCE and SSH/headless login uses a device code. Revoke logged-in devices from Settings → Account. Revocation is enforced by Onyx, not by the identity provider: every CLI request must name its own session, and creating a new session requires a fresh login that Onyx can verify (a browser login carrying a one-time nonce, or a device login whose code exchange Onyx completed itself), so a revoked device cannot rebind itself with a stored refresh token. Revoking takes effect within 30 seconds (authenticated sessions are cached briefly per server instance). Other devices signed in with the same account are unaffected.

​
Environment Overrides

Use direct overrides for scripts or CI jobs:

​
Key Actions

Store secrets in a password manager, shell secret store, or CI secret manager. Onyx only shows the secret once.