Dashboard

Authentication

Every request to the Zutrix API is authenticated with an API key sent as a bearer token.

API keys

Keys are created at zutrix.com/dashboard/settings/api and have the prefix zutrix_live_.

  • Up to 10 named keys per account — create one key per integration (e.g. "CI reports", "Internal dashboard") so they can be rotated independently.
  • Shown once — the full key is displayed only at creation. Store it in a secret manager; if you lose it, create a new key.
  • Revocable — revoke a key at any time from the dashboard. Requests with a revoked key fail immediately with 401 UNAUTHORIZED.

Header format

Send the key in the Authorization header on every request:

Header
Authorization: Bearer zutrix_live_xxxxxxxxxxxxxxxx
Terminal
curl https://api.zutrix.com/v1/me \
  -H "Authorization: Bearer $ZUTRIX_API_KEY"

A missing or invalid key returns 401 with code UNAUTHORIZED and a hint pointing at the key settings page.

Security notes

Keep keys server-side

API keys grant access to your whole workspace. Never embed them in browser JavaScript, mobile apps, or public repositories — call the API from your server and keep the key in an environment variable or secret manager.

  • Revoke on leak — if a key is exposed (committed to git, pasted in a log, shared in chat), revoke it in the dashboard immediately and create a replacement.
  • Rotate periodically — because keys are named and you can hold several, you can add a new key, migrate, then revoke the old one with zero downtime.
  • Scope by integration — separate keys per tool make audits and revocation surgical instead of disruptive.