General API Key

Open Settings → Account → General API. A key is created for you the first time you open that page. Account keys start with panda_. Regenerate replaces it, and the old key stops working right away.

On the login page choose Sign in with API key and paste the key instead of your username and password. The captcha still applies.

Send the key as X-API-Key (or Authorization: Bearer panda_…) on any dashboard endpoint, and it acts as you: list and edit services, manage keys, change Vault settings and so on.

GET /api/v1/services
Host: api.pandauth.com
X-API-Key: panda_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Keys are only read from headers, never from a ?apiKey= query string.

The service endpoints (/keys/api/*, /vss/api/* and the shortener) still take that service's own key. They also take your account key, as long as you add X-Service-Id with the service's id or identifier so the API knows which of your services you mean.

POST /api/v1/keys/api/generate
Host: api.pandauth.com
X-API-Key: panda_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
X-Service-Id: your-service-identifier
Content-Type: application/json

{ "count": 1 }

Vault V3 uses short-lived tokens. Trade your account key for one, then call the Vault V3 API with it.

# 1. Trade the account key for a short-lived Vault V3 token
curl -X POST https://api.pandauth.com/api/v1/vault-v3/session/token \
  -H "X-API-Key: panda_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

# -> { "data": { "token": "eyJ...", "expiresIn": 300, "apiBaseUrl": "https://api.pandauth.com/api/v3/vault" } }

# 2. Call Vault V3 with that token until it expires, then mint another
curl https://api.pandauth.com/api/v3/vault/scripts \
  -H "Authorization: Bearer eyJ..."

An account key always acts with normal account permissions, even on a staff account. Admin and moderator tools need a signed-in session.